Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

171–180 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#171

Post by addingnumbers »

Dudeman112 wrote: post #133
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

It would be more honest to say "We aren't able to determine whether it was exploited" which could better brace potentially impacted users for the possibility they might be affected.

This is a relatively benign case but the same language is used in other breaches when people should be taking measures like freezing their credit or reviewing financial transactions.

Re: An incident impacting 5M accounts and private information on Twitter

#172

Post by heurisko »

tick_tock_tick wrote: post #131
bink wrote: post #45

Earlier quoted context omitted.

AFAIK there is an exception for security purposes. They could be hashing or "anonymizing" the IPs and keep the data longer.

No that's not valid at all! You must remove any trace of your ability to backwards engineering the IPs. Hashing isn't sufficient since it's so easy to run over the whole IPv4 space. This is one of the trade offs.

Wouldn't salting mitigate this?

Re: An incident impacting 5M accounts and private information on Twitter

#173

Post by addingnumbers »

antisthenes wrote: post #116
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

"an absence of evidence is not evidence of absence" Isn't that taught in..uh..I dunno, middle school science class? Just because you don't see the rabbit, doesn't mean it doesn't exist.

That's why I referred to it as a psychological trick.

They should be open and forthcoming about their level of confidence, instead of using the least worrying language they can offer while remaining technically correct.

Re: An incident impacting 5M accounts and private information on Twitter

#174

Post by posix86 »

roughly wrote: post #152
Dudeman112 wrote: post #133

Earlier quoted context omitted.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

Well, “after investigating by , we were unable to find evidence it was exploited” would be a good start, as it would indicate some effort was put into disproving the hypothesis.

I'm 100% certain they did put in actual effort. If you're so keen on knowing, there's a form at the bottom you can use to ask them.

Re: An incident impacting 5M accounts and private information on Twitter

#175

Post by kbenson »

roughly wrote: post #152
Dudeman112 wrote: post #133

Earlier quoted context omitted.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

Well, “after investigating by , we were unable to find evidence it was exploited” would be a good start, as it would indicate some effort was put into disproving the hypothesis.

It provides close to nothing, because it doesn't indicate whether there was no evidence because there could be no evidence - you keep no logs - or whether there was no evidence in spite of the fact there definitely should be if it was exploited because of copious information kept that would show it.

Re: An incident impacting 5M accounts and private information on Twitter

#176

Post by SkyMarshal »

matsemann wrote: post #143

> How to Protect Your Account > (...) To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. Well, you're the ones constantly temporarily banning my account for not providing a phone number...

They said don't add a publicly known phone number to your account, so you have to create a Google Voice account that you'll never use except for account credentials like this. But Twitter will probably ban you for not using a real phone number. Or, you'll reuse that phone number across other accounts until one of them gets hacked and that phone number sold on the dark net, and now it's a public phone number again.

Re: An incident impacting 5M accounts and private information on Twitter

#178

Post by throwaway292939 »

Dudeman112 wrote: post #133
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

The phrasing is a bit more specific.. "At that time, we had no evidence.."

It could also mean "oh I spent five minutes looking into it and didn't see any evidence"

Re: An incident impacting 5M accounts and private information on Twitter

#179

Post by winternett »

HL33tibCe7 wrote: post #106

So what you’re saying is that you discovered a vulnerability that leaked the private information of your users, said absolutely nothing for 6 months, then finally came clean, but only because you were forced to because people were selling data on the deep web. Please take your “sorry” and shove it where the sun doesn’t shine. You don’t “take our privacy seriously”. This is utterly ridiculous and unacceptable, and in…

The methods to scrape numbers from social media have been published on YouTube for ages now. They share those numbers publicly because they themselves run services that share user data with other companies openly... Twitter (for example) is used as an authentication service with Disqus and a few other online apps too, an online comment service which could easily save/track sensitive ID data across comments on multiple sites unwittingly to the user, so it's a really shady overreach if that is indeed the case. These numbers are gathered under the guise of security, but they are used for entirely different purposes.

I think the real fault is in them forcing users to enter this type of data to begin with, because that makes the only options to surrender your data to them or to not use the app at all.

It would be interesting to see if numbers from verified accounts were included in the leak, that would be very telling.

Re: An incident impacting 5M accounts and private information on Twitter

#180

Post by throwaway292939 »

lysergia wrote: post #158
RonMarken wrote: post #147

Perhaps Twitter needs to make it easier to create accounts anonymously and stop virtue signaling (i.e suspend accounts created over Tor onion-service) With pseudonymous usage of public services information minimisation to maintain operational-security against private user-data being disclosed by external hackers or rogue insiders is a mantra that needs to be followed religiously.

I’m six months in and they haven’t asked for a phone number yet. I dread the day when they do. This is where proficiency in the Twilio API comes in handy.

Don't you still have to use an actual phone number when you sign up for Twilio?
Post reply on HN