Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

381–390 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#381

Post by nomilk »

rbut wrote: post #367
nomilk wrote: post #365

> If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. First time I've heard a company actually say this. It's obvious to people who understand a bit about tech and security, but not obvi…

No, that's just shifting the blame onto the user. If they are asking for something as sensitive as a mobile number, then they need to protect it properly. They ask for a mobile number to verify you're a real human, then they say "Ha it's your fault you gave us a sensitive mobile number". 99.9% of users only have one mobile, and have no idea how to get an alternate number, so they just give the number they have.

> that's just shifting the blame onto the user.

Even so, it's the first time I've seen a company actually imply to the public in plain English that they can't protect private info, rather than maintain a facade of security that doesn't actually exist.

As you point out though, if Twitter requires a phone number to sign up and 99.9% of users use their personal number, then Twitter are basically saying "our security sucks and if you want an account you have no alternative...".

Some interesting corollaries:

- Are there any services that will sign up to twitter on behalf of users? (and would they work or would it be merely shifting trust from Twitter to a potentially less trustworthy party?)

- I wonder if Twitter could consider not requiring personal info at sign up so as to avoid this dark UX

- Is there a 10 minute mail for phone numbers?

Re: An incident impacting 5M accounts and private information on Twitter

#382

Post by InCityDreams »

spicybright wrote: post #122
londons_explore wrote: post #3

So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great. But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it. It was…

I know the answer is money in politics, SV culture, etc. But it's near certainty twitter will continue as they do in and 2 weeks everyone will move on. Maybe they get a small boo-boo in the form of a symbolic fine, mangers scramble for a bit, and then the whole thing happens again and again. Why is this?

>Why is this?

Because non-twitter users don't give a fuck. And also, twitter users don't give a fuck.

Re: An incident impacting 5M accounts and private information on Twitter

#383

Post by [deleted] »

Dudeman112 wrote: post #133
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

[deleted]

Re: An incident impacting 5M accounts and private information on Twitter

#384

Post by lumost »

You know... in the last major tech bust, downsized teams working on oversized software didn't have thousands of productions services to maintain. What's a company with 10k services, and 10 languages going to do when when it comes time to patch security vulnerabilities. Or merely keep them from emerging?

Re: An incident impacting 5M accounts and private information on Twitter

#385

Post by nijave »

duckmysick wrote: post #265
RL_Quine wrote: post #38

Earlier quoted context omitted.

Rate limiting is not useful meaningfully. For a service we ran we regularly had botnets with 100k+ IP addresses making one request an hour to endpoints, which absolutely decimated the backend but hit no limits at all that a real user wouldn't also trigger. Even with a couple of requests an hour you could enumerate the entire phone number space in a very short period with that botnet.

How do you defend against such an attack? Putting a service behind something like Cloudflare won't bring it down but it will still leak the phone numbers existence, no?

Usually you'd try to make the effort/cost no longer worth the data with minimal user impact. For instance, text/email the inputted address with the result instead of displaying it to the requestor through the browser

Or if this functionality needs to return the value, require an authenticated user and impose rate limits based on reputation (which could just be account age)

For instance, Facebook and Twitter used to tell you which profile a phone number belonged to when you put it in the search box (maybe it was this issue). You could restrict that to authenticated users that were 30 days+ old and impose rate limits per day on top of that. A regular user could still look up a few numbers per day but someone enumerating phone numbers would need lots of 1 month old accounts (more effort/cost)

Re: An incident impacting 5M accounts and private information on Twitter

#386

Post by 1-6 »

lumost wrote: post #384

You know... in the last major tech bust, downsized teams working on oversized software didn't have thousands of productions services to maintain. What's a company with 10k services, and 10 languages going to do when when it comes time to patch security vulnerabilities. Or merely keep them from emerging?

Put together a ‘scrappy team’ no longer sounds professional and sustainable.

Re: An incident impacting 5M accounts and private information on Twitter

#387

Post by mellosouls »

whywhywhywhy wrote: post #139

Pretty disgusting they don't have a thing to check if they leaked my personal information, which lets not forget they screamed and stamped their feet to force me to hand over in the first place. I never wanted to give you my phone number, Twitter. You demanded it.

Pretty disgusting they don't have a thing to check if they leaked my personal information

From the linked notice, fwiw: "We will be directly notifying the account owners we can confirm were affected by this issue."

Re: An incident impacting 5M accounts and private information on Twitter

#388

Post by remram »

> we recommend not adding a publicly known phone number or email address to your Twitter account.

> While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication

I think those things are incompatible, or at least Twitter really gives that impression. Great recommendation /s

Re: An incident impacting 5M accounts and private information on Twitter

#389

Post by JuettnerDistrib »

Dudeman112 wrote: post #133
addingnumbers wrote: post #17

Earlier quoted context omitted.

"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.

It doesn't have to be a psychological trick. Sometimes you don't actually have evidence it was exploited - at which point what are you meant to say?

Other purpose than being a psychological trick, what purpose could pointing out the lack of evidence at the time have? Instead they could have written something like "We found the problem in 2021 and promptly fixed it. We first learned that it has been exploited in 2022."

Re: An incident impacting 5M accounts and private information on Twitter

#390

Post by throwawaylinux »

kadoban wrote: post #371
throwawaylinux wrote: post #364

Earlier quoted context omitted.

This certainly happens. If you speak to a corporate lawyer about a potentially sensitive issue, they will encourage you to use the phone, don't put anything in writing, and don't tell anybody especially not higher ups in the company, until you sort things out with them first.

> don't tell anybody especially not higher ups in the company As a non-lawyer, that sure sounds like sketchy advice, even beyond the rest.

How so?
Post reply on HN