Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

241–250 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#241

Post by upsidesinclude »

sangnoir wrote: post #216
addingnumbers wrote: post #171

Earlier quoted context omitted.

It would be more honest to say "We aren't able to determine whether it was exploited" which could better brace potentially impacted users for the possibility they might be affected. This is a relatively benign case but the same language is used in other breaches when people should be taking measures like freezing their credit or reviewing financial transactions.

How can anyone make any assertions about unknown unknowns? It's one thing to say "My car was stolen", and another to declare "I am unable to determine if it's en route to the Taliban."

That isn't a reasonable analogy in any way.

The only thing that could happen with the data would be that it is exploited.

The only thing that happens to stolen cars is not going to the taliban.

These are not even similar in nature. They aren't saying "the data was stolen". They also aren't saying "the data was available for exploit we are unable to determine if that occured."

What if they never looked for evidence of unauthorized access? They wouldn't have any!

This is the same as modern science and medicine frequently using this academic phrase, no evidence, when what they mean is that there has been no investigation.

Re: An incident impacting 5M accounts and private information on Twitter

#242

Post by 0x457 »

heurisko wrote: post #172
tick_tock_tick wrote: post #131

Earlier quoted context omitted.

No that's not valid at all! You must remove any trace of your ability to backwards engineering the IPs. Hashing isn't sufficient since it's so easy to run over the whole IPv4 space. This is one of the trade offs.

Wouldn't salting mitigate this?

If something uniquely identifies someone, it's considered a PII and a salted (but still useful) hash of the IP address is that. At least under GDPR. That means you will need to throw away the salt and have different salt for every instance. At that point, you might as well replace with a random string, and that isn't very useful.

"In the context of the European GDPR the Article 29 Working Party has stated that while the technique of salting and then hashing data “reduce[s] the likelihood of deriving the input value,” because “calculating the original attribute value hidden behind the result of a salted hash function may still be feasible within reasonable means,” the salted-hashed output should be considered pseudonymized data that remains subject to the GDPR."

Under CCPA, I think that is enough, HOWEVER, business must implement business processes that specifically prohibit reidentification. So again, not useful at all in this case.

The question should be is IP address a PII or not. Under CCPA and GDPR it is, but only if it “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

Re: An incident impacting 5M accounts and private information on Twitter

#243

Post by behringer »

drivebycomment wrote: post #220
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

Suppose Twitter did all it could to investigate and found no evidence. What would you rather have Twitter say in that case ?

How many man hours they spent investigating would be good.

Re: An incident impacting 5M accounts and private information on Twitter

#244

Post by newsclues »

junon wrote: post #183
drusepth wrote: post #145

Earlier quoted context omitted.

It's interesting to wonder why only 5M accounts were affected by this exploit, especially if it's brute forceable. IIRC this vulnerability was widely known about for at least months before it was fixed, so I can't imagine nobody in the know had access to the resources/botnets necessary to enumerate through every account. Have only 5M accounts linked their phone numbers on Twitter? That's less than 2% of their total a…

Phone numbers in the US. In other parts of the world, they're longer.

Us and Canada, remember we (Canada)helped invent the phone systems

Re: An incident impacting 5M accounts and private information on Twitter

#245

Post by execveat »

sangnoir wrote: post #216
addingnumbers wrote: post #171

Earlier quoted context omitted.

It would be more honest to say "We aren't able to determine whether it was exploited" which could better brace potentially impacted users for the possibility they might be affected. This is a relatively benign case but the same language is used in other breaches when people should be taking measures like freezing their credit or reviewing financial transactions.

How can anyone make any assertions about unknown unknowns? It's one thing to say "My car was stolen", and another to declare "I am unable to determine if it's en route to the Taliban."

You can make positive assertions though. E.g. attack might have been simple in which case it's possible to produce indicators that cover 100% of variants. Or it could have been complex and indicators either don't cover every possible attack or they produce large number of false positives.

Another thing to mention would be how long in the past you were able to look. E.g. in this case they have found out that the bug was introduced in 2021, were they able to inspect logs covering all of that period or did they only had limited logs/other evidence so it's impossible to know whether anyone used this opportunity or not?

Re: An incident impacting 5M accounts and private information on Twitter

#246

Post by lostcolony »

pcthrowaway wrote: post #236
diffeomorphism wrote: post #195

Earlier quoted context omitted.

That is not a normal statement if it is your company's fault the question even came up. "We left a giant tub filled with cyanide completely unsupervised in front of our door for months. We have no evidence that it was used to murder someone." Has an entirely different sound to it, no?

More like the tub was filled with water and "we have no evidence it was used to drown someone (but also we didn't check for floating bodies)"

"We left our gun outside, unsecured, but no one has complained they were shot with it and we didn't detect any fingerprints on it when we finally noticed it wasn't locked up properly"

Re: An incident impacting 5M accounts and private information on Twitter

#247

Post by mannykannot »

res0nat0r wrote: post #218
diego_sandoval wrote: post #217

Earlier quoted context omitted.

The burden of proof should fall on them to demonstrate that it wasn't exploited. Otherwise, the reasonable thing to do is to assume that it was exploited, because they have no evidence to show that it wasn't. The phrase is a psychological trick because it creates the illusion that the burden of proof falls on the other side.

You can't prove a negative.

In which case, the second paragraph applies.

Re: An incident impacting 5M accounts and private information on Twitter

#248

Post by upupandup »

lysergia wrote: post #158
RonMarken wrote: post #147

Perhaps Twitter needs to make it easier to create accounts anonymously and stop virtue signaling (i.e suspend accounts created over Tor onion-service) With pseudonymous usage of public services information minimisation to maintain operational-security against private user-data being disclosed by external hackers or rogue insiders is a mantra that needs to be followed religiously.

I’m six months in and they haven’t asked for a phone number yet. I dread the day when they do. This is where proficiency in the Twilio API comes in handy.

when I started liking "too many" tweets I got hit with it and my mobile carrier (canada btw) refused to deliver txt msgs from Twitter so I could never get verified.

Re: An incident impacting 5M accounts and private information on Twitter

#249

Post by rrix2 »

pcthrowaway wrote: post #236
diffeomorphism wrote: post #195

Earlier quoted context omitted.

That is not a normal statement if it is your company's fault the question even came up. "We left a giant tub filled with cyanide completely unsupervised in front of our door for months. We have no evidence that it was used to murder someone." Has an entirely different sound to it, no?

More like the tub was filled with water and "we have no evidence it was used to drown someone (but also we didn't check for floating bodies)"

or: "keeping fine grained indexed API logs around for months on end is too expensive so we threw out the body with the bathwater"

Re: An incident impacting 5M accounts and private information on Twitter

#250

Post by mewpmewp2 »

jazzyjackson wrote: post #160
Dudeman112 wrote: post #133

Earlier quoted context omitted.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

"we have no way of knowing" is a much more informative statement than "we have no evidence", but it belies fallibility on the part of the speaker.

"We have no way of knowing" may not be correct statement. There could always be a way to know that you may have missed. It would be inhuman to claim "we have no way of knowing" in circumstances like this.
Post reply on HN