Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

461–470 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#461

Post by macksd »

martin_a wrote: post #448
midoridensha wrote: post #410

Earlier quoted context omitted.

It's absolutely true. All US numbers are 555-xxxx. You can see this in any US movie or TV show, which we know to be very accurate. Similarly, any time an American car has a fender-bender, or at least one of its wheels leaves the ground, it explodes in a massive fireball.

That's what's really holding me back from getting an American car. Just fearing that somebody might hit my car and then it's over.

Independent of Hollywood, some American cars just might do that. Maybe not in such an impressive manner, but I've been through so many Dodge transmissions and Ford's reputation here is even worse.

Re: An incident impacting 5M accounts and private information on Twitter

#462

Post by spurgu »

mccorrinall wrote: post #457
spurgu wrote: post #450

Earlier quoted context omitted.

As I said, not defending them. They are likely doing dozens of other things as well. But using phone numbers is a quite effective method of hindering spam/bot account creation - in most countries in Europe at least getting a prepaid SIM requires ID nowadays. Not that Twitter would go as far as to inquire ownership records of phone numbers... but/so you could still go and buy 100 SIM cards if you wanted to, but it'd b…

No spammer ever buys sim cards in store with ID. 5sim.net apparently has direct SS7 access and nearly infinite numbers and offers bulk purchases for receiving SMS. Even for countries like Germany, where ID authentication is mandatory to get a phone number. They have thousands of +49 numbers. Costs only a few rubles. If you convert it to euros it’s between 1-10 cents, depending on the service and country. The bottom l…

Oh, that's interesting. I wonder how they get past regulation in countries like Germany as you said. I'd assume they'd have to be registered as an official operator there?

PS. I wasn't aware of SS7, reading up on it now.

Re: An incident impacting 5M accounts and private information on Twitter

#463

Post by winternett »

nomilk wrote: post #365

> If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. First time I've heard a company actually say this. It's obvious to people who understand a bit about tech and security, but not obvi…

Twitter often FORCED users to enter a valid phone number by locking accounts, and then verified if it was active in comparison to accounts. To this day there is no way to remove the phone number or disassociate it with an account. Please do not oversimplify the offense, it does not do justice to the cited issues involved.

Re: An incident impacting 5M accounts and private information on Twitter

#464

Post by lijogdfljk »

anderiv wrote: post #319
lijogdfljk wrote: post #295

Earlier quoted context omitted.

Do you have something against TOTP? Isn't it better than Authy?

Authy is a TOTP app.

Ah, i thought Authy was a service. So.. why can't OP use Authy with Google?

Google Auth is just TOTP, yet Authy is not capable of using it somehow? I'm so confused lol. I've used plenty of TOTP apps with Google.

Re: An incident impacting 5M accounts and private information on Twitter

#465

Post by unethical_ban »

brabel wrote: post #422
unethical_ban wrote: post #402

Earlier quoted context omitted.

It's a solved problems that you never confirm or deny the registration of an identity (like email or phone) for your service. Bad login? "Not a valid user/pass combo" Password recovery? No matter what email or phone provided, simply say "If the email matches our records, we will send a recovery link".

Until the UX team comes in and demands "better error messages".

Possibly, but a good org will empower security teams to make that call and collaborate with UX on a safe compromise.

Re: An incident impacting 5M accounts and private information on Twitter

#466

Post by lrvick »

NaturalPhallacy wrote: post #272
lrvick wrote: post #264

Earlier quoted context omitted.

They also refuse voip numbers. I am now at 20 back and forth emails with Discord support explaining I do not own a cell phone. They are seriously suggesting I buy one just to use Discord.

I've seriously considered buying burner phones like a goddamn drug dealer for bullshit like this.

Cell phone numbers require KYC in almost all countries so they put people that require anonymity at risk.

Re: An incident impacting 5M accounts and private information on Twitter

#467

Post by joegahona »

bergenty wrote: post #350
joegahona wrote: post #301

Earlier quoted context omitted.

I was just able to remove my phone number from my account settings and wandered into a Fred Sanford-level of junk data -- Twitter had me identified as a female (I'm male), had "interests" tied to me for both "Alexandria Ocasio-Cortez" and "Ben Shapiro" (they're most certainly not), and had my languages as "French" and "Indonesian" (I know only English). Bad digital hygiene.

I don’t even know how an algorithm can tie someone to AOC and Ben Shapiro at the same time. What on earth are you browsing.

I hate politics, follow neither of those people, nor have ever knowingly clicked on content about either. I'm browsing geeky product-management tweets, '80s pro wrestling, music, and random tech.

Re: An incident impacting 5M accounts and private information on Twitter

#468

Post by joegahona »

archon810 wrote: post #337
joegahona wrote: post #301

Earlier quoted context omitted.

I was just able to remove my phone number from my account settings and wandered into a Fred Sanford-level of junk data -- Twitter had me identified as a female (I'm male), had "interests" tied to me for both "Alexandria Ocasio-Cortez" and "Ben Shapiro" (they're most certainly not), and had my languages as "French" and "Indonesian" (I know only English). Bad digital hygiene.

Can you please identify the steps to get to these interest settings?

On desktop/web:

Three-dot "More" > Settings and Privacy > Privacy and Safety > Content You See > Interests

"These are some of the interests matched to you based on your profile, activity, and the Topics you follow. These are used to personalize your experience across Twitter, including the ads you see. You can adjust your interests if something doesn’t look right. Any changes you make may take a little while to go into effect."

Re: An incident impacting 5M accounts and private information on Twitter

#469

Post by twelvedogs »

eli wrote: post #191
jazzyjackson wrote: post #169

Earlier quoted context omitted.

it adds a small cost to creating sockpoppets but it adds much larger value in having personal data for targeted ads like my sibling said, twitter was dishonest to their users how the phone number was to be used if it's just to prevent bot signups, why keep it on file at all?

They no longer use it for ads, so the value now is just fraud and security. > if it's just to prevent bot signups, why keep it on file at all? I mean, you need the actual number for 2FA. I guess maybe you could hash it after some amount of time just for blocking bots? You couldn't just discard it or one number could create unlimited bots.

Multiple companies have been caught using information for ads that they said they wouldn't, and Twitter have already proven that they're not trust worthy
Post reply on HN