Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Parler Databases Disclosed

twitter.com

Post reply on HN
Print view View original

11–20 of 168 posts

Re: Parler Databases Disclosed

#11

Post by brobdingnagians »

fabian2k wrote: post #8

How would disabling Twilio disable authentication entirely? From what I see it is used to send SMS and maybe Email as well. So I could understand that it would prevent login, registration and password reset if that service is offline, but it shouldn't allow any of these without authentication. Unless the software skipped authentication entirely when this service was unavailable, which I find hard to imagine. But that…

It appears Okta also banned them, they must have default succeeded instead of default fail, maybe an interaction between the two?:

https://twitter.com/okta/status/1348191370528256002?s=20

Re: Parler Databases Disclosed

#13

Post by Udik »

neya wrote: post #4

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…

> Because Twilio was no longer authenticating emails.

Can someone explain what does this mean?

Re: Parler Databases Disclosed

#14

Post by CommieDetector »

Veen wrote: post #10
osgovernment wrote: post #3

If you're not signed up as a foster/adoptive parent, now is a good time if you want to have an impact. There are going to be a lot of kids flooding into the system from families that felt emboldened to become domestic terrorists by the President and those he surrounds himself with.

I can't think of a more effective way to spark a civil war than threatening to take people's children from them.

Leftists will do anything

Re: Parler Databases Disclosed

#15

Post by osgovernment »

Veen wrote: post #10
osgovernment wrote: post #3

If you're not signed up as a foster/adoptive parent, now is a good time if you want to have an impact. There are going to be a lot of kids flooding into the system from families that felt emboldened to become domestic terrorists by the President and those he surrounds himself with.

I can't think of a more effective way to spark a civil war than threatening to take people's children from them.

Well many of them will hopefully have family that is able to take the role, but sometimes the consequences of a failed insurrection aren't well thought out.

Re: Parler Databases Disclosed

#16

Post by fabian2k »

brobdingnagians wrote: post #11
fabian2k wrote: post #8

How would disabling Twilio disable authentication entirely? From what I see it is used to send SMS and maybe Email as well. So I could understand that it would prevent login, registration and password reset if that service is offline, but it shouldn't allow any of these without authentication. Unless the software skipped authentication entirely when this service was unavailable, which I find hard to imagine. But that…

It appears Okta also banned them, they must have default succeeded instead of default fail, maybe an interaction between the two?: https://twitter.com/okta/status/1348191370528256002?s=20

That would be extremely careless, and I find it very hard to believe that this happened.

An unlikely, but more plausible option to me would be that after removal of the Parler account, someone else was able to register the same account and gain access that way. But that doesn't fit the description all that well, and I'd also expect that this would not work at all if the authentication service is not very careless.

Re: Parler Databases Disclosed

#17

Post by Hamuko »

Veen wrote: post #10
osgovernment wrote: post #3

If you're not signed up as a foster/adoptive parent, now is a good time if you want to have an impact. There are going to be a lot of kids flooding into the system from families that felt emboldened to become domestic terrorists by the President and those he surrounds himself with.

I can't think of a more effective way to spark a civil war than threatening to take people's children from them.

I thought the implication was that they'd be dead or in prison.

Re: Parler Databases Disclosed

#18

Post by dgellow »

Udik wrote: post #13
neya wrote: post #4

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…

> Because Twilio was no longer authenticating emails. Can someone explain what does this mean?

Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.

Re: Parler Databases Disclosed

#19

Post by scotty79 »

Wait. So how did it work exactly? Why would you get to reset password after clicking "I forgot password?"

I thought password reset flow is initiated from the email link not from "Forgot password" link and just paused till email link is clicked.

Re: Parler Databases Disclosed

#20

Post by Mindwipe »

fabian2k wrote: post #16
brobdingnagians wrote: post #11

Earlier quoted context omitted.

It appears Okta also banned them, they must have default succeeded instead of default fail, maybe an interaction between the two?: https://twitter.com/okta/status/1348191370528256002?s=20

That would be extremely careless, and I find it very hard to believe that this happened. An unlikely, but more plausible option to me would be that after removal of the Parler account, someone else was able to register the same account and gain access that way. But that doesn't fit the description all that well, and I'd also expect that this would not work at all if the authentication service is not very careless.

Parler's infrastructure was extremely carelessly built in lots of ways, so it doesn't shock me.
Post reply on HN