101–110 of 1001 posts
Earlier quoted context omitted.
Would it be any better if it was sent to Wikileaks and published there?
Only if it the data was government / private sector data, not citizen messages
"Trump storming the US Capitol on January 6, 2021"
While as we know very well, chicken shit (and/or delusional?) as he is, Trump himself did no such thing.
When you purposefully leak private data, you no longer get to hide behind the title "Security Researcher".
Would it be any better if it was sent to Wikileaks and published there?
This story truly terrifies me: my team owns my company's sign up page. (I speak for myself and not them, of course). Sounds like Parler, fearing that their OTP provider might go down, decided to fail-open, ie: if the dependency throws an exception, presume there's something wrong with the dependency and that the code provided is acceptable. It never occurred to them that the dependency could be down permanently, or t…
Agreed that the problem looks like 'fail open', but there is the additional possibility that they had no plan for this failure mode at all beyond timing out. In that context, and with folks with no regard for consequences in charge, an emergency decision to allow everything seems plausible.
Where are the comments about how awful it is for people's private messages to be leaked? Or is this okay because the media told me these guys are the bad guys.
Just call everyone a terrorist and absolve your soul of any uneasiness you have with this. Surely this hyperbole hasn't been used in recent history to push authoritarian and unethical measures by state and private actors paving a golden road to hell.
Sounds like Twillo was actively helping hackers "That allowed them to see which users had moderator rights and this in turn allowed them to reset passwords of existing users with simple “forgot password” function. Since Twilio no longer authenticated emails, hackers were able to access admin accounts with ease."
Twilio shut down the account and Parler decided to pass all verification attempts instead.
Earlier quoted context omitted.
Huh? Wikileaks is where people go to publish evidence of government crimes, not Granddad's chats with his friends.
Wikileaks leaked John Podesta's emails, including such criminal activity as his recipe for risotto.
Parler is not good, but stealing and publishing this information is also not traditionally ethical.
This story truly terrifies me: my team owns my company's sign up page. (I speak for myself and not them, of course). Sounds like Parler, fearing that their OTP provider might go down, decided to fail-open, ie: if the dependency throws an exception, presume there's something wrong with the dependency and that the code provided is acceptable. It never occurred to them that the dependency could be down permanently, or t…
There's a surprising amount of insecure code in the wild; and naive engineers who are willingly ignorant in their security practices. I'd assume that Parler's engineers motivations had more to do with politics than providing a secure platform for protecting dissidents under duress. (Or, if we look at the history of a recent major war, the mediocre engineers working for the other side thought they were the good guys.)
Fairly sure we could replace algorithm and data structure whiteboard interviews with security interviews and we'd all be better off
Earlier quoted context omitted.
Seems implausible. Why would anyone design a system that way. I suspect it must be a more complicated combination of circumstances as it often is.
This assumes it was by design, likely someone unfamiliar with the security implications thought they were improving the customer experience by not failing hard.
if not twilio_authenticate(user, pass):
return Err()
return User(user)
def twilio_authenticate(user, pass):
try:
return twilio.verify(user)
except:
return False
Where are the comments about how awful it is for people's private messages to be leaked? Or is this okay because the media told me these guys are the bad guys.
The ramifications of this will absolutely set a record for the future as the inevitable reverse will happen. People are forgetting that if they're ok with this sort of behavior now, it'll be difficult for them to argue-against or prevent the same behavior when their opposites are in control.