Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

441–450 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#441

Post by spiddy »

daenz wrote: post #414
duckmysick wrote: post #265

Earlier quoted context omitted.

How do you defend against such an attack? Putting a service behind something like Cloudflare won't bring it down but it will still leak the phone numbers existence, no?

Don't leak whether or not the phone number belongs to an account. All failed login attempts should be some form of "Invalid login" regardless of whether or not it was an attempt against an actual account or not.

Also worth noting that time response deviance when user exists or not can also be a leak of info

Re: An incident impacting 5M accounts and private information on Twitter

#442

Post by DharmaPolice »

unethical_ban wrote: post #402
londons_explore wrote: post #10

Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.

It's a solved problems that you never confirm or deny the registration of an identity (like email or phone) for your service. Bad login? "Not a valid user/pass combo" Password recovery? No matter what email or phone provided, simply say "If the email matches our records, we will send a recovery link".

What about new user sign up? Most systems will tell you if an email address has already been registered (and it seems hard to get round that).

Re: An incident impacting 5M accounts and private information on Twitter

#443

Post by vinay_ys »

I have seen too many services that ask phone number for account recovery purposes and then end up using it for other purposes for which the user didn't consent. Given how insecure SMS OTP is, I try not to enable that if I can avoid it. Then, on top of it, bugs like this make the service behave like a globally accessible open reverse-directory of mobile numbers to names.

How is twitter notifying users? Has anyone posted screenshots of this notification? I want to know where this notice will appear.

Re: An incident impacting 5M accounts and private information on Twitter

#444

Post by vinay_ys »

cudder wrote: post #436
quickthrower2 wrote: post #336

Earlier quoted context omitted.

Maybe they should store salted hashes of phone numbers. The purposes of phone numbers: 1. Verify you are a not a bot: no need to store anything except TRUE once verified. 2. 2FA - well use something better than SMS, but if you must, store the hash, and make me enter my number for the 2FA each time. Compare with hash and then send SMS.

Non-geeks dislike the hassle of 2FA enough as it is, having to enter their phone number every time too sounds like it would hurt adoption quite significantly.

With technology like FIDO Passkey built into newer phones (both iOS and Android), I see passwordless multi-factor attested auth becoming the standard for most services very soon. Then, users will have to do even less to get more security.

Re: An incident impacting 5M accounts and private information on Twitter

#445

Post by vinay_ys »

DharmaPolice wrote: post #442
unethical_ban wrote: post #402

Earlier quoted context omitted.

It's a solved problems that you never confirm or deny the registration of an identity (like email or phone) for your service. Bad login? "Not a valid user/pass combo" Password recovery? No matter what email or phone provided, simply say "If the email matches our records, we will send a recovery link".

What about new user sign up? Most systems will tell you if an email address has already been registered (and it seems hard to get round that).

You can always show that message after email is verified. Don't reveal information without verifying the ownership of email or phone number.

Re: An incident impacting 5M accounts and private information on Twitter

#446

Post by spurgu »

vinay_ys wrote: post #443

I have seen too many services that ask phone number for account recovery purposes and then end up using it for other purposes for which the user didn't consent. Given how insecure SMS OTP is, I try not to enable that if I can avoid it. Then, on top of it, bugs like this make the service behave like a globally accessible open reverse-directory of mobile numbers to names. How is twitter notifying users? Has anyone post…

Not defending them but I think a major reason why Twitter (and for example Gmail nowadays) is asking for phone numbers is to decrease spam accounts (which is of course a good thing in itself).

Re: An incident impacting 5M accounts and private information on Twitter

#447

Post by switch007 »

spurgu wrote: post #446
vinay_ys wrote: post #443

I have seen too many services that ask phone number for account recovery purposes and then end up using it for other purposes for which the user didn't consent. Given how insecure SMS OTP is, I try not to enable that if I can avoid it. Then, on top of it, bugs like this make the service behave like a globally accessible open reverse-directory of mobile numbers to names. How is twitter notifying users? Has anyone post…

Not defending them but I think a major reason why Twitter (and for example Gmail nowadays) is asking for phone numbers is to decrease spam accounts (which is of course a good thing in itself).

How did they arrive at phone numbers? What other options did they try. It’s too easy to give companies a pass “because spam”

Re: An incident impacting 5M accounts and private information on Twitter

#448

Post by martin_a »

midoridensha wrote: post #410
knolan wrote: post #287

Earlier quoted context omitted.

And all US numbers begin with 555, or so I’m lead to believe.

It's absolutely true. All US numbers are 555-xxxx. You can see this in any US movie or TV show, which we know to be very accurate. Similarly, any time an American car has a fender-bender, or at least one of its wheels leaves the ground, it explodes in a massive fireball.

That's what's really holding me back from getting an American car. Just fearing that somebody might hit my car and then it's over.

Re: An incident impacting 5M accounts and private information on Twitter

#449

Post by ivxvm »

Isn't this widely known and very old trick? I'm pretty sure I even saw youtube tutorials and non-techy people discussing there is a way to find a person's twitter account by their number. This article says like it's something recent that was only available for short time and quickly fixed. Doesn't seem like that at all.

Re: An incident impacting 5M accounts and private information on Twitter

#450

Post by spurgu »

switch007 wrote: post #447
spurgu wrote: post #446

Earlier quoted context omitted.

Not defending them but I think a major reason why Twitter (and for example Gmail nowadays) is asking for phone numbers is to decrease spam accounts (which is of course a good thing in itself).

How did they arrive at phone numbers? What other options did they try. It’s too easy to give companies a pass “because spam”

As I said, not defending them. They are likely doing dozens of other things as well. But using phone numbers is a quite effective method of hindering spam/bot account creation - in most countries in Europe at least getting a prepaid SIM requires ID nowadays. Not that Twitter would go as far as to inquire ownership records of phone numbers... but/so you could still go and buy 100 SIM cards if you wanted to, but it'd be way more expensive than just spawning new email addresses.
Post reply on HN