What unit is mm? Millimetres?
This abbreviation is not in the article (nor is the number). And the HN headline now says "5M" which is maybe a more common abbreviation for "million".
An incident impacting 5M accounts and private information on Twitter
321–330 of 479 posts
Re: An incident impacting 5M accounts and private information on Twitter
#322>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.
I was just able to remove my phone number from my account settings and wandered into a Fred Sanford-level of junk data -- Twitter had me identified as a female (I'm male), had "interests" tied to me for both "Alexandria Ocasio-Cortez" and "Ben Shapiro" (they're most certainly not), and had my languages as "French" and "Indonesian" (I know only English). Bad digital hygiene.
Seems like they're doing a good job of keeping your identity veiled.
Re: An incident impacting 5M accounts and private information on Twitter
#323Earlier quoted context omitted.
Rate limiting should be used to mitigate this, although I suppose a botnet could overcome that to some extent proportional to the size of the botnet. And for anyone who didn't read TFA, this incident goes well beyond leaking what phone numbers use the product, it leaked the usernames associated with each as well.
Rate limiting is not useful meaningfully. For a service we ran we regularly had botnets with 100k+ IP addresses making one request an hour to endpoints, which absolutely decimated the backend but hit no limits at all that a real user wouldn't also trigger. Even with a couple of requests an hour you could enumerate the entire phone number space in a very short period with that botnet.
Out of curiosity, how does someone possibly get 100k+ IP addresses? I had enough trouble getting 1 public IP address.
Re: An incident impacting 5M accounts and private information on Twitter
#324Anyone else annoyed by the growing use of the word "impact" to speak increasingly passively? People are so afraid to make a claim nowadays, even if it's obviously true. They speak of "impacts" or that something will be "impacted". But they seem to want to avoid saying who or what will be impacted. "I was impacted by today's layoffs." "We expect there to be impacts to website traffic." These meaningless words do nothi…
Exactly. They're giving the least information possible to formulate a coherent headline which is technically accurate. If they told the truth in the headline, it would get WAY more clicks. These are clicks they don't want.
Re: An incident impacting 5M accounts and private information on Twitter
#325>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.
Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.
Google will allow you to use (and they prefer, and you should too) a Security Key. I use this wherever I can. I don't Tweet, but if I did it would be secured with Security Keys. I have Facebook only inside a single contain on one machine, secured with Security Keys. And so on for many services. More services should do WebAuthn.
Re: An incident impacting 5M accounts and private information on Twitter
#326>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.
Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.
Replying to everyone who said to use Google Authenticator. I in fact did fall for the devious wording that implied no other Auth app would work but never fear, even that is not an option for my account now that I'm checking. The only available options are physical security keys (which I lack), phone numbers (which I won't disclose), and tapping a notification on an Android phone (which ties me even more into the Google ecosystem and I'd rather not pick). I'll appreciate any comments if anyone knows how to get a TOTP going with Authy for Gmail, don't assume I know everything and I'm willfully ignoring it!
Re: An incident impacting 5M accounts and private information on Twitter
#327Earlier quoted context omitted.
You know Google Authenticator is just an implementation of the TOTP open standard right? There are plenty of alternative apps that will give you the same number to key in...
Totally understandable GP wouldn't know that, from what I recall of logging in to a Google account when I did that at all often (a few years ago, but relatively recently) Google does its best to hide that. (If you want it, mine's another recommendation for Authy.)
Yeah I did not know you could use any TOTP besides Google Auth but even that that's not an option that's presented to me anymore at the moment now that I'm checking.
Re: An incident impacting 5M accounts and private information on Twitter
#328I thought this was going to be a tongue in cheek announcement to wit-
A chaos actor with malintent executed a social engineering attack and thereby acquired sensitive private data from several million active human accounts with the goal we believe to misclassify humans as bots and thereby thwart the actor's own publicly but impulsively stated goal of acquiring Twitter and becoming custodian of this data. This actor is still at large though we expect to see him in Delaware Chancery Court in September where he will be punished for his impulsive chaos.
Re: An incident impacting 5M accounts and private information on Twitter
#329Earlier quoted context omitted.
Rate limiting is not useful meaningfully. For a service we ran we regularly had botnets with 100k+ IP addresses making one request an hour to endpoints, which absolutely decimated the backend but hit no limits at all that a real user wouldn't also trigger. Even with a couple of requests an hour you could enumerate the entire phone number space in a very short period with that botnet.
Out of curiosity, how does someone possibly get 100k+ IP addresses? I had enough trouble getting 1 public IP address.
People build botnets by enticing people to install trojans on their computers, e.g. a free utility app or game.
They can then earn money from people who want to rent access to these botnets.
There are also free VPN services who, in their fine print, say that users grant them permission to route other traffic via their connections.
Re: An incident impacting 5M accounts and private information on Twitter
#330Earlier quoted context omitted.
Curious what kind of logs/analytics would you add and watch to catch something like this?
You should notice a spike in any request logging metric if someone exploits this.
Depends on the normal usage, if someone was doing this across unique ips and slow enough that the usage change may be say 1% it wouldn't be noticed.
A more sophisticated system that could look at the ips in use and compare to previously used ips for the accounts would notice something.