291–300 of 308 posts
I feel stupid for just realizing that social media account save previous passwords? How far back does it go?
Earlier quoted context omitted.
This is by far the most eyebrow-raising part of the update. To take over such a large number of verified accounts and then run a download on only eight non-verified ones seems almost impossible to have been anything other than targeted. The original idea that the bitcoin scam was a diversion starts to look more plausible in this light, but in the absence of any information about the downloaded accounts, there’s reall…
The idea that someone would opt out of downloading Elon masks or Jeff bezos’ DMs is insane. Completely and perfectly insane. Not to mention the other people. Even if just in terms of profit, clearly the dms of the richest man in the world have enough value to just click download. It seems like the probability of this guy passing it up due to lack of interest is very small. Slightly more likely is that he was overwhel…
To me the really irresponsible bit is that they kept the service up knowing full well there was a live attack in progress and they had not yet found a way to stop it. The Big Red Button has a place and the time to use it was last week. Given the prominence of the accounts that were compromised there isn't a shadow of doubt that shutting it down was the only responsible course of action. The world will continue to spi…
> Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack. I feel stupid for just realizing that social media account save previous passwords? How far back does it go?
If you know the value of N (from UI errors trying to reuse one) and want them to get rid of an old hash for some reason then you could reset your password N times.
> Attackers were able to view personal information including email addresses and phone numbers, which are displayed to some users of our internal support tools. Can anyone explain to me why the phone number is stored in plain text for them to see?
In case you need to call them?
This is horrible. Twitter forced me at some point to provide my phone number. I never wanted it.
Earlier quoted context omitted.
Has anyone stepped forward and claimed they were scammed yet? It's normal for scammers to pay themselves to make their scam look more legitimate. If no one steps forward... it's not impossible that they actually didn't manage to scam anyone.
You're right, but it's also normal for people to be ashamed of getting scammed and not come forward. I have a friend who got scammed by altcoiners and lost most of his BTC even though I warned him many times. He didn't tell me this for many years because he was ashamed. At this time he doesn't have any chance of buying so many Bitcoins again ever in his life. Leaving those messages up for so much time (at least an ho…
It's true-- but ... no one?
> Leaving those messages up for so much time (at least an hour) was unacceptable anyways.
They were actually still up many hours later and hidden for browsers only by javascript. Pretty remarkable when you consider that almost all of them had a bitcoin address or similar in them and could have been safely substring matched.
Earlier quoted context omitted.
I think that the fact the world will continue to spin without twitter is exactly why the hesitated to make that type of call.
There is a scene in The Simpsons where TV stops working and the children suddenly have to go outside and play. Great happiness ensues. That is exactly the scene I imagine if Twitter were turned off.
If Twitter were to vanish suddenly would these people be bothered by it for more than a month? I'm thinking there has to be at least a handful of such people.
Also, anecdotally, I heard of a parent taking away their son's game console since they were worried he was playing it all day. His response was to stare at the wall for the same amount of time instead.
I wonder what implications there would be around forcibly preventing people from using social networks if they're already wired to be used to social media.
Earlier quoted context omitted.
They could've just said "...as this is not possible" or something like that. I wasn't suggesting they need to drop in acronyms like PBKDF2 or whatever. They go out of their way to say "through the tools used in the attack" which might as well imply there are other tools through which the passwords are available...
They said "those [passwords] are not stored in plain text or available through the tools used in the attack." - "Or" means both clauses are true. I think it most likely means, the passwords are hashed, and the hashes aren't available in this tool. There's undoubtedly other tools that allow people to view the hash, (Mysql command line client is a "tool" after all ;) Although I agree the statement is ambiguous enough,…