Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

451–460 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#451

Post by [deleted] »

junon wrote: post #183
drusepth wrote: post #145

Earlier quoted context omitted.

It's interesting to wonder why only 5M accounts were affected by this exploit, especially if it's brute forceable. IIRC this vulnerability was widely known about for at least months before it was fixed, so I can't imagine nobody in the know had access to the resources/botnets necessary to enumerate through every account. Have only 5M accounts linked their phone numbers on Twitter? That's less than 2% of their total a…

Phone numbers in the US. In other parts of the world, they're longer.

[deleted]

Re: An incident impacting 5M accounts and private information on Twitter

#452

Post by misterS »

nomilk wrote: post #365

> If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. First time I've heard a company actually say this. It's obvious to people who understand a bit about tech and security, but not obvi…

Two days ago, I've tried to create an account tied only to an email. During account creation, the wizard suddenly inserted an additional step and required my to enter a phone number.

I realise though that this is possibly an anti-spam measure (which I'm in favour of), since I've connected through Tor when creating the account. But this procedure stands in stark contrast to the advise given in the article.

Re: An incident impacting 5M accounts and private information on Twitter

#453

Post by croes »

vlovich123 wrote: post #54
croes wrote: post #29

Earlier quoted context omitted.

But you can abandon a number after you registered on Twitter. Doesn't help against agencies but against scrappers

Doesn't that make account takeovers easy?

My social media accounts are all disposable, so it doesn't really matter to me.

Re: An incident impacting 5M accounts and private information on Twitter

#454

Post by lynndotpy »

soperj wrote: post #223
lynndotpy wrote: post #57

Earlier quoted context omitted.

My very recent experience contradicts this. I removed my number and was immediately locked out until I added it back.

They mean you can get a different phone number, not remove it from twitter.

Ah, I misunderstood that comment entirely. This makes more sense

Re: An incident impacting 5M accounts and private information on Twitter

#455

Post by mannykannot »

kadoban wrote: post #374
mannykannot wrote: post #247

Earlier quoted context omitted.

In which case, the second paragraph applies.

But then you might as well just assume everything is compromised, at all times, even if there's been no announcement. They could just not be telling you. Which is maybe not the worst strategy, but it's going to be pretty exhausting. I'd suggest that instead we should just expect and enforce a certain amount of openness and honesty from companies when they fuck up in this way, so we can make informed decisions.

Well, yes - this is the dilemma which is not resolved with empty platitudes, even though "you can't prove a negative."

In the US and elsewhere, there are already some penalties for covering up a problem, and they should be expanded commensurately with the potential harm.

Re: An incident impacting 5M accounts and private information on Twitter

#456

Post by spywaregorilla »

jtbayly wrote: post #373
nomilk wrote: post #365

> If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. First time I've heard a company actually say this. It's obvious to people who understand a bit about tech and security, but not obvi…

No. That’s not practical advice. Twitter is gaslighting us. You can’t use Twitter without a phone number. They require it.

I signed up for twitter a couple weeks ago to follow some ukraine folks. They didn't require a phone number and just double checking my account doesn't have one.

Re: An incident impacting 5M accounts and private information on Twitter

#457

Post by mccorrinall »

spurgu wrote: post #450
switch007 wrote: post #447

Earlier quoted context omitted.

How did they arrive at phone numbers? What other options did they try. It’s too easy to give companies a pass “because spam”

As I said, not defending them. They are likely doing dozens of other things as well. But using phone numbers is a quite effective method of hindering spam/bot account creation - in most countries in Europe at least getting a prepaid SIM requires ID nowadays. Not that Twitter would go as far as to inquire ownership records of phone numbers... but/so you could still go and buy 100 SIM cards if you wanted to, but it'd b…

No spammer ever buys sim cards in store with ID. 5sim.net apparently has direct SS7 access and nearly infinite numbers and offers bulk purchases for receiving SMS. Even for countries like Germany, where ID authentication is mandatory to get a phone number. They have thousands of +49 numbers.

Costs only a few rubles. If you convert it to euros it’s between 1-10 cents, depending on the service and country.

The bottom line is: IDs for sim cards are useless.

Re: An incident impacting 5M accounts and private information on Twitter

#459

Post by vageli »

nomilk wrote: post #365

> If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. First time I've heard a company actually say this. It's obvious to people who understand a bit about tech and security, but not obvi…

If they actually cared they would make that statement in bold at the time they ask for your phone number and email address.

Re: An incident impacting 5M accounts and private information on Twitter

#460

Post by himinlomax »

spywaregorilla wrote: post #456
jtbayly wrote: post #373

Earlier quoted context omitted.

No. That’s not practical advice. Twitter is gaslighting us. You can’t use Twitter without a phone number. They require it.

I signed up for twitter a couple weeks ago to follow some ukraine folks. They didn't require a phone number and just double checking my account doesn't have one.

They require it most of the time, and not always at first. Do anything remotely controversial, like retweeting a non-conformist, and they likely will.
Post reply on HN