Earlier quoted context omitted.
Maybe Musk is right, they are all bots.
Maybe Musk is behind this to weasel out of the contract?
Yes he certainly is; he also reported it afterwards via HackerOne to get that $5k bounty. Two birds one stone.
An incident impacting 5M accounts and private information on Twitter
421–430 of 479 posts
Re: An incident impacting 5M accounts and private information on Twitter
#422Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
It's a solved problems that you never confirm or deny the registration of an identity (like email or phone) for your service. Bad login? "Not a valid user/pass combo" Password recovery? No matter what email or phone provided, simply say "If the email matches our records, we will send a recovery link".
Until the UX team comes in and demands "better error messages".
Re: An incident impacting 5M accounts and private information on Twitter
#423Earlier quoted context omitted.
Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.
Replying to everyone who said to use Google Authenticator. I in fact did fall for the devious wording that implied no other Auth app would work but never fear, even that is not an option for my account now that I'm checking. The only available options are physical security keys (which I lack), phone numbers (which I won't disclose), and tapping a notification on an Android phone (which ties me even more into the Goog…
2-step verification can be turned on by going to https://myaccount.google.com/ and selecting security and then "Signing in to Google". The "2-step verification" finally leads to the point where phone number is asked for enabling SMS based verification. Only after enabling SMS based verification it is possible to enable Authenticator App (TOTP) or some other options.
At least I couldn't find other way to enable TOTP i.e. first SMS.
Re: An incident impacting 5M accounts and private information on Twitter
#424Facebook had a very similar information leak just a couple of years ago. It is amazing these companies seem to learn very little from each other when it comes to protecting personal information.
And look how bad it turned out for them...
Re: An incident impacting 5M accounts and private information on Twitter
#425seems more about doxing and in this case large scale.
being able to attach identities to numbers.
as for brut forcing I'm sure they have limited attempts among other measures.
Re: An incident impacting 5M accounts and private information on Twitter
#426I believe this is the vulnerability reported to Twitter which awarded $5000 from its bug bounty program. https://hackerone.com/reports/1439026
Anyone have any idea how many of these bounties are collected by people who actively look (seems like a hard way to make a living) vs. say people with some knowledge who stumble across the issue and wouldn't take the time to properly report, otherwise (might convince me to take a couple of hours)?
Re: An incident impacting 5M accounts and private information on Twitter
#427Earlier quoted context omitted.
That is not a normal statement if it is your company's fault the question even came up. "We left a giant tub filled with cyanide completely unsupervised in front of our door for months. We have no evidence that it was used to murder someone." Has an entirely different sound to it, no?
How does it have a different sound? "We left a giant tub filled with cyanide completely unsupervised in front of our door for months. We have no evidence that it was used to murder someone." No one would say that second sentence, if you don't have evidence of something you don't state that because of the set of objects and events that didn't happen is infinite. "We left a giant tub filled with cyanide completely unsu…
What was your train of thought from "we made a giant mistake. We have no evidence of consequences, yet." to "that person owns a gun legally"?
Re: An incident impacting 5M accounts and private information on Twitter
#428Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
Maybe they should store salted hashes of phone numbers. The purposes of phone numbers: 1. Verify you are a not a bot: no need to store anything except TRUE once verified. 2. 2FA - well use something better than SMS, but if you must, store the hash, and make me enter my number for the 2FA each time. Compare with hash and then send SMS.
Didn’t downvote and think your idea is reasonable, but worth noting that twitter currently needs unhashed phone numbers for:
- Account search during password recovery (lets users search for their account by phone number): https://twitter.com/account/begin_password_reset
- User discoverability and account recommendations (users who upload their address books can find others by phone number, users who share their number can be found by others): https://help.twitter.com/en/using-twitter/account-suggestion...
Hashing numbers has other implications, like support impact (some folks don’t know their own phone number), preventing the ability to offer SMS updates in countries that need it (or to reactivate that feature in national emergencies for countries that SMS support was pulled from), as well as making potential marketing, data mining, satisfying legal requests, and future feature development harder.
So your suggestion is a good one for a privacy-conscious service that doesn’t already depend on (or that is unwilling to relinquish) unhashed numbers, but it probably isn’t in the nature of twitter to seek to protect user data at the expense of existing or future features, even after leaks like this.
Re: An incident impacting 5M accounts and private information on Twitter
#429> we recommend not adding a publicly known phone number or email address to your Twitter account. > While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication I think those things are incompatible, or at least Twitter really gives that impression. Great recommendation /s
[deleted]
Re: An incident impacting 5M accounts and private information on Twitter
#430Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
already doable with e-mail addresses. doing this with just a phone number is not really a problem. It is a problem when you can link the phone and email. But discovering a phonenumber in itself is nothing more then pressing random numbers and see who answers?