Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

151–160 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#151

Post by lysergia »

matsemann wrote: post #143

> How to Protect Your Account > (...) To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. Well, you're the ones constantly temporarily banning my account for not providing a phone number...

Strange you say that. I’m six months into my pseudonymous account and they haven’t tried to extort my phone number. It’s like they know from my behavior that I don’t want to be doxxed by Twitter Inc. I signed up using a VPN and a weird email address, and used an AD blocker.

Re: An incident impacting 5M accounts and private information on Twitter

#152

Post by roughly »

Dudeman112 wrote: post #133
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

Well, “after investigating by , we were unable to find evidence it was exploited” would be a good start, as it would indicate some effort was put into disproving the hypothesis.

Re: An incident impacting 5M accounts and private information on Twitter

#153

Post by lewantmontreal »

Dudeman112 wrote: post #133
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

’We have no proof this wasn’t exploited’

Re: An incident impacting 5M accounts and private information on Twitter

#154

Post by lysergia »

throw03172019 wrote: post #75

>If you operate a pseudonymous Twitter account…we recommend not adding a publicly known phone number to your Twitter account. Dear Twitter, We need a phone number to be able to use Twitter longer than a week otherwise we get blocked for “suspicious activity” (which is entirely bullshit - logging in from the same IP is not suspicious). So what should we do? Go to AT&T and open a new line? Jokers.

No post body was provided.

Re: An incident impacting 5M accounts and private information on Twitter

#155

Post by zaarn »

hunter2_ wrote: post #82
RL_Quine wrote: post #59

Earlier quoted context omitted.

That has some problems. If you limit the total number of attempts globally then the feature is effectively disabled, every botnet and script will blow through the attempt budget and real users can't use it. Global limits and IP address limits are not useful, and because we're assuming the user is unauthenticated (using the password reset), we have no other way of distinguishing good traffic.

Captcha comes to mind, but that's a cat-and-mouse game in the age of machine learning (not to mention actual humans working for a bad actor). Cloudflare seems to be on the cutting edge with their newest challenge mechanism, but good vs bad is somewhat distinct from human vs script.

Solving a few thousand captchas an hour costs you like 200$ per day. Forget about it if someone is dedicated.

Re: An incident impacting 5M accounts and private information on Twitter

#156

Post by busymom0 »

lysergia wrote: post #151
matsemann wrote: post #143

> How to Protect Your Account > (...) To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. Well, you're the ones constantly temporarily banning my account for not providing a phone number...

Strange you say that. I’m six months into my pseudonymous account and they haven’t tried to extort my phone number. It’s like they know from my behavior that I don’t want to be doxxed by Twitter Inc. I signed up using a VPN and a weird email address, and used an AD blocker.

Do they shadowban such accounts? Are you aware if your posts and comments are visible to others?

Re: An incident impacting 5M accounts and private information on Twitter

#158

Post by lysergia »

RonMarken wrote: post #147

Perhaps Twitter needs to make it easier to create accounts anonymously and stop virtue signaling (i.e suspend accounts created over Tor onion-service) With pseudonymous usage of public services information minimisation to maintain operational-security against private user-data being disclosed by external hackers or rogue insiders is a mantra that needs to be followed religiously.

I’m six months in and they haven’t asked for a phone number yet. I dread the day when they do. This is where proficiency in the Twilio API comes in handy.

Re: An incident impacting 5M accounts and private information on Twitter

#159

Post by busymom0 »

vidarh wrote: post #115
cheshire137 wrote: post #111

The page isn’t loading for me and I notice Twitter itself is either slow or not loading at all right now. I also see a spike in reported problems for Twitter on DownDetector.

It loads for me in the browser, but the app is failing to load data. EDIT: A few refreshes shows it's slow and occasionally failing in the browser for me...

Twitter was actually down for few minutes. It just got fixed.

Re: An incident impacting 5M accounts and private information on Twitter

#160

Post by jazzyjackson »

Dudeman112 wrote: post #133
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

"we have no way of knowing" is a much more informative statement than "we have no evidence", but it belies fallibility on the part of the speaker.
Post reply on HN