Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

411–420 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#411

Post by EGreg »

myself248 wrote: post #80
londons_explore wrote: post #3

So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great. But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it. It was…

The whole announcement reeks of "Stop hitting yourself!" What scum. They had lots of chances to fix this, the first one being not collecting phone numbers in the first place. They chose to do that, and then they didn't adequately protect it, and now they're oh so very surprised that someone might be doxing their most vulnerable users. If anyone is harmed by this, Twitter should be held liable.

It's not just Twitter. It happens every few months. The problem is centralized sites having "real name policies", requiring you to put your phone number and other crap: https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says...

Re: An incident impacting 5M accounts and private information on Twitter

#413

Post by throwaway742 »

NaturalPhallacy wrote: post #272
lrvick wrote: post #264

Earlier quoted context omitted.

They also refuse voip numbers. I am now at 20 back and forth emails with Discord support explaining I do not own a cell phone. They are seriously suggesting I buy one just to use Discord.

I've seriously considered buying burner phones like a goddamn drug dealer for bullshit like this.

Burn phone as a service.

Re: An incident impacting 5M accounts and private information on Twitter

#414

Post by daenz »

duckmysick wrote: post #265
RL_Quine wrote: post #38

Earlier quoted context omitted.

Rate limiting is not useful meaningfully. For a service we ran we regularly had botnets with 100k+ IP addresses making one request an hour to endpoints, which absolutely decimated the backend but hit no limits at all that a real user wouldn't also trigger. Even with a couple of requests an hour you could enumerate the entire phone number space in a very short period with that botnet.

How do you defend against such an attack? Putting a service behind something like Cloudflare won't bring it down but it will still leak the phone numbers existence, no?

Don't leak whether or not the phone number belongs to an account. All failed login attempts should be some form of "Invalid login" regardless of whether or not it was an attempt against an actual account or not.

Re: An incident impacting 5M accounts and private information on Twitter

#415

Post by wnevets »

AlexanderTheGr8 wrote: post #323
RL_Quine wrote: post #38

Earlier quoted context omitted.

Rate limiting is not useful meaningfully. For a service we ran we regularly had botnets with 100k+ IP addresses making one request an hour to endpoints, which absolutely decimated the backend but hit no limits at all that a real user wouldn't also trigger. Even with a couple of requests an hour you could enumerate the entire phone number space in a very short period with that botnet.

Out of curiosity, how does someone possibly get 100k+ IP addresses? I had enough trouble getting 1 public IP address.

botnets. With all of the crappy IoT devices out there it is even easier to get inside of consumers networks.

Re: An incident impacting 5M accounts and private information on Twitter

#416

Post by 8organicbits »

tomjakubowski wrote: post #397
mrb wrote: post #125

Earlier quoted context omitted.

"Quite a bit"? Filtering out ***555**** removes only 0.1% of phone numbers ;)

I didn't do the math here but: Filtering out 5*... would remove 10% of the search space. (dots mean "followed by more stars") Filtering out *5*... would remove 1%. So wouldn't ***555**** remove closer to 0.01%, not 0.1%?

Try the math, this is a good problem to work through. The position of the 5 doesn't impact the search space like that. 10% of the 10 digit numbers start with a 5. 10% of the 10 digit numbers end with a 5. 5... in your example shouldn't be 1%.

Re: An incident impacting 5M accounts and private information on Twitter

#417

Post by onionisafruit »

munchler wrote: post #224
drusepth wrote: post #145

Earlier quoted context omitted.

It's interesting to wonder why only 5M accounts were affected by this exploit, especially if it's brute forceable. IIRC this vulnerability was widely known about for at least months before it was fixed, so I can't imagine nobody in the know had access to the resources/botnets necessary to enumerate through every account. Have only 5M accounts linked their phone numbers on Twitter? That's less than 2% of their total a…

5,000,000 seconds is about two months. The attackers simply might not have had enough time to check more numbers than that. (Assumption: They were checking only one number per second, either to avoid detection or because they were rate-limited.)

What percent of mobile numbers do you think are associated with twitter accounts? I don’t know, but it wouldn’t surprise me to find out they had to try 500M or more numbers to find 5M accounts.

Re: An incident impacting 5M accounts and private information on Twitter

#418

Post by kadoban »

throwawaylinux wrote: post #390
kadoban wrote: post #371

Earlier quoted context omitted.

> don't tell anybody especially not higher ups in the company As a non-lawyer, that sure sounds like sketchy advice, even beyond the rest.

How so?

Seems both ethically questionable and maybe not the best strategy for the individual if they're being instructed to keep information to themselves instead of passing it up the chain in the company. Is that intended to keep just that employee responsible for whatever mess?

Re: An incident impacting 5M accounts and private information on Twitter

#419

Post by onionisafruit »

jtbayly wrote: post #373
nomilk wrote: post #365

> If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. First time I've heard a company actually say this. It's obvious to people who understand a bit about tech and security, but not obvi…

No. That’s not practical advice. Twitter is gaslighting us. You can’t use Twitter without a phone number. They require it.

Combine the advice with the fact that a phone number is required and you get the practical advice: don’t use twitter.

Re: An incident impacting 5M accounts and private information on Twitter

#420

Post by quickthrower2 »

quickthrower2 wrote: post #336
londons_explore wrote: post #10

Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.

Maybe they should store salted hashes of phone numbers. The purposes of phone numbers: 1. Verify you are a not a bot: no need to store anything except TRUE once verified. 2. 2FA - well use something better than SMS, but if you must, store the hash, and make me enter my number for the 2FA each time. Compare with hash and then send SMS.

Downvote explainer?
Post reply on HN