Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

70TB of Parler users’ messages, videos, and posts leaked by security researchers

cybernews.com

Post reply on HN
Print view View original

191–200 of 1001 posts

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#191

Post by mcintyre1994 »

> With this type of access, newly minted users were able to get behind the login box API used for content delivery. That allowed them to see which users had moderator rights and this in turn allowed them to reset passwords of existing users with simple “forgot password” function. Since Twilio no longer authenticated emails, hackers were able to access admin accounts with ease.

Can anyone make sense of this? In all the "forgot password" functions I've seen, you click "forgot password" and they email you a link to reset the password. How does "Twilio won't send our emails any more" lead to the "forgot password" function allowing account takeovers? I'd have expected it to just make "forgot password" no longer work because nobody can get a reset link any more. I can't figure out how you could configure things for this to lead to a security flaw this bad - other than "write all emails that fail to send somewhere public" which I can't imagine anyone doing. I can't imagine Twilio writing rejected emails from a closed down account somewhere public either. How does Twilio shutting down the account mean password reset links leak?

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#192

Post by whatshisface »

BlueTemplar wrote: post #187
whatshisface wrote: post #97

Earlier quoted context omitted.

It's generally a good idea for leakers to be selective about their releases (Snowden did a better job than Manning in that area IMO). I guess Wikileaks is between a rock and a hard place, because if they started editorializing then that would lead to political bias.

They sided against the US government (and with Russia) years ago.

Has anyone leaked something about Russia that was then denied by Wikileaks? It could be that the US has a more active community of investigative journalists.

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#193

Post by BlueTemplar »

valvar wrote: post #96
RoyTyrell wrote: post #64

Earlier quoted context omitted.

Would it be any better if it was sent to Wikileaks and published there?

Yes, because WikiLeaks is very diligent in scrubbing sensitive private information from leaks.

They aren't, or did they get much better at it in recent years?

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#194

Post by [deleted] »

boredumb wrote: post #40
stuckindider wrote: post #30

Where are the comments about how awful it is for people's private messages to be leaked? Or is this okay because the media told me these guys are the bad guys.

Just call everyone a terrorist and absolve your soul of any uneasiness you have with this. Surely this hyperbole hasn't been used in recent history to push authoritarian and unethical measures by state and private actors paving a golden road to hell.

[deleted]

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#195

Post by prof-dr-ir »

ForHackernews wrote: post #126
thomastjeffery wrote: post #39

When you purposefully leak private data, you no longer get to hide behind the title "Security Researcher".

AFAIK, they have not publicly released any data dumps from this (yet? Maybe they're planing to). If I were sitting on a dataset like this, I'd probably try to share it with the authorities like the FBI and selected journalists who I feel would behave responsibly.

Sorry but no 'security researcher' is supposed to be gathering such a massive dataset in the first place. The moment you use a vulnerability to download any private information, even as proof of concept, you are on very thin ice - both legally and (in my view) ethically.

If I were twitter user @donk_enby I would be very worried about an imminent visit by law enforcement.

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#196

Post by varvar »

stuckindider wrote: post #30

Where are the comments about how awful it is for people's private messages to be leaked? Or is this okay because the media told me these guys are the bad guys.

It's amazing isn't it? Principles, ethics.. all talk for a lot of people, situations like these show it. Watch them spin it as a good thing for humanity as a whole. Amazing.

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#197

Post by iamEAP »

mabbo wrote: post #8

This story truly terrifies me: my team owns my company's sign up page. (I speak for myself and not them, of course). Sounds like Parler, fearing that their OTP provider might go down, decided to fail-open, ie: if the dependency throws an exception, presume there's something wrong with the dependency and that the code provided is acceptable. It never occurred to them that the dependency could be down permanently, or t…

More speculation on my part: I wonder if rather than a fail-open decision, it’s just how they designed local dev to work and the failure of the provider caused the app to behave as if in local dev mode.

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#198

Post by Pfhreak »

cbgonz wrote: post #131

Hmmm... comes close to lynching a ton of people, if you ask me. Never mind who´s right or wrong, the point is that we all agree upon trusting a judicial system to do this kind of thing, don´t we?

These folks had their private messages exposed. In no way is that "close to lynching".

Depending on what the user posted, they might be embarrassed, lose their jobs, or end up in court.

We can have a reasonable discussion about the ethics of hacking a site like parler, but not if the starting point is "this is the equivalent of violent mobs literally murdering innocent people".

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#199

Post by BitwiseFool »

ceilingcorner wrote: post #165
go13 wrote: post #161

Earlier quoted context omitted.

I'm surprised to see how many people can not think for themselves but follow what media is telling them. I hope I don't do that myself but try to understand the matter and follow principles rather than sides. What I'm surprised the most is that with these complex and not obvious questions (at least to me) people without any shadow of a doubt are certain that it is right for big tech to censor Trump, shut down parler…

You are currently witnessing the result of defunding humanities in favor of technical education.

I have a feeling most of the professors in the Humanities departments would be not at all sympathetic to Parler or all the deplatforming happening around Donald Trump and his supporters. If anything they'd be broadcasting the Karl Popper "Paradox of Tolerance" as justification for everything that's been happening this week.

Re: 70TB of Parler users’ messages, videos, and posts leaked by security researchers

#200

Post by nullc »

yalogin wrote: post #162
nullc wrote: post #51

Earlier quoted context omitted.

Don't worry, the "hacked material" rule on twitter will prevent anything derived from this being posted on twitter. Right???

Applying the rules uniformly means Twitter should wait 4 yrs and then ban them. I am sure you will agree to that.

You're referring to 2024 when twitter will ban the NY Times for posting materials derived from the orange clown's taxes and the NY Post for posting materials derived from the President-elect's son's laptop?

Ah. Wait. They took one of these actions within an hour of it going up. :P I suppose it'll be no time at all until they take down the account of the person hacking Parler and live tweeting the content being discussed in this article... which they've been doing for that past ... 48 hours.

Post reply on HN