Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

401–410 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#401

Post by phreack »

tialaramex wrote: post #325
phreack wrote: post #284

Earlier quoted context omitted.

Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.

Google will allow you to use (and they prefer, and you should too) a Security Key. I use this wherever I can. I don't Tweet, but if I did it would be secured with Security Keys. I have Facebook only inside a single contain on one machine, secured with Security Keys. And so on for many services. More services should do WebAuthn.

I hear you but they're expensive where I live. For the moment that's not an option though I'm looking into getting one at some point.

Re: An incident impacting 5M accounts and private information on Twitter

#402

Post by unethical_ban »

londons_explore wrote: post #10

Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.

It's a solved problems that you never confirm or deny the registration of an identity (like email or phone) for your service.

Bad login? "Not a valid user/pass combo"

Password recovery? No matter what email or phone provided, simply say "If the email matches our records, we will send a recovery link".

Re: An incident impacting 5M accounts and private information on Twitter

#403

Post by hackernewds »

stygiansonic wrote: post #400
remram wrote: post #388

> we recommend not adding a publicly known phone number or email address to your Twitter account. > While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication I think those things are incompatible, or at least Twitter really gives that impression. Great recommendation /s

The full sentence states: While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication using authentication apps or hardware security keys to protect your account from unauthorized logins. So it actually does not imply adding a phone number, which is seemingly what you have tried to imply with the cut-off quote provided.

Intentional drudgery? inconceivable!

Re: An incident impacting 5M accounts and private information on Twitter

#404

Post by hackernewds »

NelsonMinar wrote: post #33

Isn't this the second or third time for Twitter to have this exact same flaw? From 2020: https://www.socialmediatoday.com/news/twitter-uncovers-secur... I might be confused; this is a very old feature of Twitter that does have an opt out. Maybe this new disclosure is the opt out didn't work? https://help.twitter.com/en/safety-and-security/email-and-ph... It's a different problem, but this year Twitter also got a $150…

We consistently have to go through Data protection practices, and limit the purpose of what the data collected can be used for. This seems like either a blatant miss in process, or willful ignore where $150m is under the EXPECTED value of the rewards through marketing

Re: An incident impacting 5M accounts and private information on Twitter

#405

Post by hackernewds »

myself248 wrote: post #80
londons_explore wrote: post #3

So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great. But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it. It was…

The whole announcement reeks of "Stop hitting yourself!" What scum. They had lots of chances to fix this, the first one being not collecting phone numbers in the first place. They chose to do that, and then they didn't adequately protect it, and now they're oh so very surprised that someone might be doxing their most vulnerable users. If anyone is harmed by this, Twitter should be held liable.

didn't actually not just protect the phone numbers. They actively used it illegally to market services outside of the purpose for which the numbers were gathered

https://www.theverge.com/2022/5/25/23141968/ftc-doj-twitter-...

Re: An incident impacting 5M accounts and private information on Twitter

#406

Post by exodust »

stygiansonic wrote: post #400
remram wrote: post #388

> we recommend not adding a publicly known phone number or email address to your Twitter account. > While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication I think those things are incompatible, or at least Twitter really gives that impression. Great recommendation /s

The full sentence states: While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication using authentication apps or hardware security keys to protect your account from unauthorized logins. So it actually does not imply adding a phone number, which is seemingly what you have tried to imply with the cut-off quote provided.

> "it actually does not imply adding a phone number"

It actually does.

The sentence you quoted contains the link "enable 2-factor authentication", which goes to a page where adding a phone number is the FIRST method described.

"There are three methods to choose from: Text message, Authentication app, or Security key..... If you don’t already have a phone number associated with your account, we’ll prompt you to enter it."

Re: An incident impacting 5M accounts and private information on Twitter

#407

Post by kfichter »

lrvick wrote: post #266
Nexxxeh wrote: post #129

Earlier quoted context omitted.

$5k seems embarrassingly low so something with such horrendous impact. Potentially allowing for doxing, and because phone numbers are the lynchpin for many 2FA and consumer-facing telco security is generally lax, total user hijacking across multiple platforms. What an absolute disaster.

I have found many far more serious bugs, even at larger companies, that have paid me under $500. No one feels security researchers time is even worth that of the internal engineers creating the bugs.

Crypto bounties pay quite well; https://immunefi.com/

Re: An incident impacting 5M accounts and private information on Twitter

#408

Post by SXX »

AlexanderTheGr8 wrote: post #323
RL_Quine wrote: post #38

Earlier quoted context omitted.

Rate limiting is not useful meaningfully. For a service we ran we regularly had botnets with 100k+ IP addresses making one request an hour to endpoints, which absolutely decimated the backend but hit no limits at all that a real user wouldn't also trigger. Even with a couple of requests an hour you could enumerate the entire phone number space in a very short period with that botnet.

Out of curiosity, how does someone possibly get 100k+ IP addresses? I had enough trouble getting 1 public IP address.

There are "residential proxy services" offering exactly this and you only ever pay for bandwidth. Using 100,000 unique non-datacenter IPs will only cost you few thousand dollars as long as you only sending tiny API requests.

And this is service offered by registered Israeli company that get formal agreement from "bots" to route traffic through them. Very shady, but totally legal service that used by a lot of data collection agencies for price tracking on Amazon or getting data from Linkedin, etc.

Re: An incident impacting 5M accounts and private information on Twitter

#410

Post by midoridensha »

knolan wrote: post #287
junon wrote: post #183

Earlier quoted context omitted.

Phone numbers in the US. In other parts of the world, they're longer.

And all US numbers begin with 555, or so I’m lead to believe.

It's absolutely true. All US numbers are 555-xxxx. You can see this in any US movie or TV show, which we know to be very accurate.

Similarly, any time an American car has a fender-bender, or at least one of its wheels leaves the ground, it explodes in a massive fireball.

Post reply on HN