Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

291–300 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#291

Post by kernelcurry »

phreack wrote: post #284
NaturalPhallacy wrote: post #270

>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.

Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.

That is not entirely true. If I remember correctly, if you select the Google Authenticator as your option, it will display a QR code. You can then scan the QR code and the OTP information will be in that payload that can then be pasted into you app of choose. (How o got mine I to 1Password)

Re: An incident impacting 5M accounts and private information on Twitter

#292

Post by autoexec »

spicybright wrote: post #122
londons_explore wrote: post #3

So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great. But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it. It was…

I know the answer is money in politics, SV culture, etc. But it's near certainty twitter will continue as they do in and 2 weeks everyone will move on. Maybe they get a small boo-boo in the form of a symbolic fine, mangers scramble for a bit, and then the whole thing happens again and again. Why is this?

Because twitter users care more about the convince twitter provides than they do about the risks their privacy and security as a result of using twitter. I suspect most have no idea what the risks are or have some very limited idea of some of them. Maybe if they had a better understanding of the risks they'd close their accounts and move to something new, but I doubt there be enough of them to cause twitter to invest in securing the unnecessary amounts of data they collect.

This sort of thing will only be fixed when we hold companies accountable for failing to protect customer data through regulation with many rows of sharp teeth.

Re: An incident impacting 5M accounts and private information on Twitter

#293

Post by londons_explore »

phreack wrote: post #284
NaturalPhallacy wrote: post #270

>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.

Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.

You know Google Authenticator is just an implementation of the TOTP open standard right? There are plenty of alternative apps that will give you the same number to key in...

Re: An incident impacting 5M accounts and private information on Twitter

#294

Post by procombo »

Lutger wrote: post #273
asddubs wrote: post #262

Earlier quoted context omitted.

I wonder, if you destroy all the evidence this was exploited, can you still claim you don't have any evidence this was exploited? Asking for opinions from non-lawyers only please

To be sure, use a clean room implementation: let IT destroy all the evidence, always. Then legal can claim 'we don't have any evidence'. source: I am not a lawyer

Works the same way with government. The "I am not aware of ..." is a great trick for when your organization is intentionally silod. The folks who get subpoenaed are left out of detailed info. It's a complete non-statement.

I could bring up examples across both sides of the isle. It's all a big game.

Re: An incident impacting 5M accounts and private information on Twitter

#295

Post by lijogdfljk »

phreack wrote: post #284
NaturalPhallacy wrote: post #270

>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.

Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.

Do you have something against TOTP? Isn't it better than Authy?

Re: An incident impacting 5M accounts and private information on Twitter

#296

Post by tick_tock_tick »

zaarn wrote: post #150
tick_tock_tick wrote: post #131

Earlier quoted context omitted.

No that's not valid at all! You must remove any trace of your ability to backwards engineering the IPs. Hashing isn't sufficient since it's so easy to run over the whole IPv4 space. This is one of the trade offs.

You can if the hash collides within the IPv4 address space; ie it's a hash of less than about 16 bits. Enough to let your roughly see if something fishy is going on but you can't reverse engineer to any specific IP, only a set of 64 thousand.

That isn't good enough. By taking that hash and old request data combined with your current request logs it's enough to de-anonymization a significant portion of those logs making you not in compliance.

Re: An incident impacting 5M accounts and private information on Twitter

#297

Post by wlesieutre »

londons_explore wrote: post #293
phreack wrote: post #284

Earlier quoted context omitted.

Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.

You know Google Authenticator is just an implementation of the TOTP open standard right? There are plenty of alternative apps that will give you the same number to key in...

Authy included

Re: An incident impacting 5M accounts and private information on Twitter

#300

Post by OJFord »

londons_explore wrote: post #293
phreack wrote: post #284

Earlier quoted context omitted.

Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.

You know Google Authenticator is just an implementation of the TOTP open standard right? There are plenty of alternative apps that will give you the same number to key in...

Totally understandable GP wouldn't know that, from what I recall of logging in to a Google account when I did that at all often (a few years ago, but relatively recently) Google does its best to hide that.

(If you want it, mine's another recommendation for Authy.)

Post reply on HN