Twitter has 2 factors. Turn it on. Then not just phone.
An incident impacting 5M accounts and private information on Twitter
431–440 of 479 posts
Re: An incident impacting 5M accounts and private information on Twitter
#432Earlier quoted context omitted.
How so?
Seems both ethically questionable and maybe not the best strategy for the individual if they're being instructed to keep information to themselves instead of passing it up the chain in the company. Is that intended to keep just that employee responsible for whatever mess?
> Seems both ethically questionable
Right, but how so? A person or company can get into trouble with things being written down or made known to others. Having a lawyer consider it first is legally prudent and is entirely reasonable and common advice given out to any person (don't speak to police/regulator/other party/internet/newspaper/etc before consulting your lawyer). If you think that's ethically sound advice for a person, then what changes the calculus for a corporation?
> and maybe not the best strategy for the individual if they're being instructed to keep information to themselves instead of passing it up the chain in the company. Is that intended to keep just that employee responsible for whatever mess?
Probably less instructed to keep it to yourself, more encouraged to stick to "official" reporting channels, and then when you do that or come into contact with such issues by other means, more encouragement to use the phone.
And it completely depends on what it is as to the intention I guess. Initially so that the lawyers are able to consider and advise. But sure you aren't paying the lawyer so they are only taking care of your interests so far as that coincides with the company's interests. So if you had a concern that you would be responsible for a legal problem, or are a victim of a criminal or civil legal matter from the company or another person in it, then I would say you should consider discussing that with your own lawyer.
Re: An incident impacting 5M accounts and private information on Twitter
#433> "At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. "
This sounds misleading or incompetent. If someone was harvesting data, then logs would indicate how many such login attempts were being made per second/minute/hour/day and the activity would spike in certain days, times, geographical areas to suggest this kind of activity is going on.
Even if the attacker was really careful spreading their activity over long periods of time & routing it via multiple geographical areas, the overall activity would show an uptick before & after the bug.
I find it highly unlikely that a company of the size of Twitter could not ascertain from their internal data that a bug like this was exploited or not.
Re: An incident impacting 5M accounts and private information on Twitter
#434Earlier quoted context omitted.
Phone numbers in the US. In other parts of the world, they're longer.
And all US numbers begin with 555, or so I’m lead to believe.
joking aside, the 5M figure probably came from targeting like this, such as choosing a few area codes with high tech populations and testing the ~10M phone numbers for each area
Re: An incident impacting 5M accounts and private information on Twitter
#435Earlier quoted context omitted.
5,000,000 seconds is about two months. The attackers simply might not have had enough time to check more numbers than that. (Assumption: They were checking only one number per second, either to avoid detection or because they were rate-limited.)
What percent of mobile numbers do you think are associated with twitter accounts? I don’t know, but it wouldn’t surprise me to find out they had to try 500M or more numbers to find 5M accounts.
We'd need to actually test it. But I believe the finding ratio would be even lower than 1 in 100.
Re: An incident impacting 5M accounts and private information on Twitter
#436Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
Maybe they should store salted hashes of phone numbers. The purposes of phone numbers: 1. Verify you are a not a bot: no need to store anything except TRUE once verified. 2. 2FA - well use something better than SMS, but if you must, store the hash, and make me enter my number for the 2FA each time. Compare with hash and then send SMS.
Non-geeks dislike the hassle of 2FA enough as it is, having to enter their phone number every time too sounds like it would hurt adoption quite significantly.
Re: An incident impacting 5M accounts and private information on Twitter
#437Earlier quoted context omitted.
Maybe they should store salted hashes of phone numbers. The purposes of phone numbers: 1. Verify you are a not a bot: no need to store anything except TRUE once verified. 2. 2FA - well use something better than SMS, but if you must, store the hash, and make me enter my number for the 2FA each time. Compare with hash and then send SMS.
Didn’t downvote and think your idea is reasonable, but worth noting that twitter currently needs unhashed phone numbers for: - Account search during password recovery (lets users search for their account by phone number): https://twitter.com/account/begin_password_reset - User discoverability and account recommendations (users who upload their address books can find others by phone number, users who share their numbe…
Not to mention that only having salted hashes will make it harder for them to link your advertising profile with other data brokers.
Re: An incident impacting 5M accounts and private information on Twitter
#438Earlier quoted context omitted.
Discord is also like this and it drives me nuts.
They also refuse voip numbers. I am now at 20 back and forth emails with Discord support explaining I do not own a cell phone. They are seriously suggesting I buy one just to use Discord.
I usually don't do ads, however there is a tool called SMS pva where you can rent phone numbers specific for services for a one time confirmation. You usually get a working one on first try.
I can't even count how many companies suggested that I should 'just get a phone number' to use their service.
Re: An incident impacting 5M accounts and private information on Twitter
#439So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great. But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it. It was…
Requiring a phone number is part of fraud & spam prevention. Maybe you'd make a different tradeoff but that's not "no reason."
I pay about $0.2 for a working phone number instantly via API. Or pennies for packs of aged accounts. Do you actually think that stops anything?
Re: An incident impacting 5M accounts and private information on Twitter
#440Perhaps Twitter needs to make it easier to create accounts anonymously and stop virtue signaling (i.e suspend accounts created over Tor onion-service) With pseudonymous usage of public services information minimisation to maintain operational-security against private user-data being disclosed by external hackers or rogue insiders is a mantra that needs to be followed religiously.
I’m six months in and they haven’t asked for a phone number yet. I dread the day when they do. This is where proficiency in the Twilio API comes in handy.
That's crazy. I can't remember the last time I wasn't straight up locked within 2 minutes of my first login.
Guess Linux users are bad, or whatever makes them trigger each f*ING time.