Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

161–170 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#161

Post by lysergia »

busymom0 wrote: post #156
lysergia wrote: post #151

Earlier quoted context omitted.

Strange you say that. I’m six months into my pseudonymous account and they haven’t tried to extort my phone number. It’s like they know from my behavior that I don’t want to be doxxed by Twitter Inc. I signed up using a VPN and a weird email address, and used an AD blocker.

Do they shadowban such accounts? Are you aware if your posts and comments are visible to others?

I checked. I have a few alt accounts and all my tweets and interactions are visible when I visit my profile.

Re: An incident impacting 5M accounts and private information on Twitter

#162

Post by Tenobrus »

Dudeman112 wrote: post #133
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

I mean in practice what it tends to mean is the logs only had a 3 month ttl so really could be either way. "no evidence" implies there is at least a place there could have been evidence, they looked, and didn't find any, which is a weak but nonzero update towards it having not happened. It would be nice if they clarified exactly what they checked.

Re: An incident impacting 5M accounts and private information on Twitter

#163

Post by skrtskrt »

Is this going to be the thing that gets Elon Musk off the hook for his billion dollar fine for backing out of the deal?

They had a breach and actively actively hid it for an extended period of time. Obviously both sides have good lawyers, but it's hard to see how this doesn't hurt Twitter in regards to the legal battle over the Musk deal unwinding

Re: An incident impacting 5M accounts and private information on Twitter

#164

Post by cdash »

drusepth wrote: post #145
londons_explore wrote: post #10

Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.

It's interesting to wonder why only 5M accounts were affected by this exploit, especially if it's brute forceable. IIRC this vulnerability was widely known about for at least months before it was fixed, so I can't imagine nobody in the know had access to the resources/botnets necessary to enumerate through every account. Have only 5M accounts linked their phone numbers on Twitter? That's less than 2% of their total a…

Maybe Musk is right, they are all bots.

Re: An incident impacting 5M accounts and private information on Twitter

#165

Post by tromp »

ryandrake wrote: post #86
HL33tibCe7 wrote: post #76

Can we have a proper postmortem about this please, with information about the exact process that was required to obtain this information? > We take our responsibility to protect your privacy very seriously and it is unfortunate that this happened. Patently not seriously enough.

It's always hilarious: Whenever any company is caught not taking X seriously, the first thing they do is issue a press release that starts with "Here at COMPANY, we take X very seriously!"

Reminds me of how certain spam emails will proudly proclaim: This is not spam!

Re: An incident impacting 5M accounts and private information on Twitter

#167

Post by zrobotics »

cheshire137 wrote: post #111

The page isn’t loading for me and I notice Twitter itself is either slow or not loading at all right now. I also see a spike in reported problems for Twitter on DownDetector.

Archive link in case anyone is still having issues: https://archive.ph/HujUg

Re: An incident impacting 5M accounts and private information on Twitter

#168

Post by busymom0 »

lysergia wrote: post #161
busymom0 wrote: post #156

Earlier quoted context omitted.

Do they shadowban such accounts? Are you aware if your posts and comments are visible to others?

I checked. I have a few alt accounts and all my tweets and interactions are visible when I visit my profile.

And this is even when you visit the post (from someone else) which you reply to while being signed out of your account and your IP address?

Most shadow banning show the posts if visited via the profile but are invisible if viewed as replies to someone else's post or while signed out and using different IP address. Might be worth checking. Not asserting that this is the case with Twitter though.

Re: An incident impacting 5M accounts and private information on Twitter

#169

Post by jazzyjackson »

eli wrote: post #101
londons_explore wrote: post #3

So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great. But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it. It was…

Requiring a phone number is part of fraud & spam prevention. Maybe you'd make a different tradeoff but that's not "no reason."

it adds a small cost to creating sockpoppets but it adds much larger value in having personal data for targeted ads

like my sibling said, twitter was dishonest to their users how the phone number was to be used

if it's just to prevent bot signups, why keep it on file at all?

Post reply on HN