I've stopped using twitter.com for consumption of tweets and only user nitter.net now. It works most of the time. If your use case for twitter is similar to mine, read-only, it may be useful for you as well.
An incident impacting 5M accounts and private information on Twitter
331–340 of 479 posts
Re: An incident impacting 5M accounts and private information on Twitter
#332Earlier quoted context omitted.
Totally understandable GP wouldn't know that, from what I recall of logging in to a Google account when I did that at all often (a few years ago, but relatively recently) Google does its best to hide that. (If you want it, mine's another recommendation for Authy.)
Yeah I did not know you could use any TOTP besides Google Auth but even that that's not an option that's presented to me anymore at the moment now that I'm checking.
The nice thing about TOTP is i can put it in my password manager which makes life a whole lot more convenient. W for open standards.
Re: An incident impacting 5M accounts and private information on Twitter
#333Earlier quoted context omitted.
I was just able to remove my phone number from my account settings and wandered into a Fred Sanford-level of junk data -- Twitter had me identified as a female (I'm male), had "interests" tied to me for both "Alexandria Ocasio-Cortez" and "Ben Shapiro" (they're most certainly not), and had my languages as "French" and "Indonesian" (I know only English). Bad digital hygiene.
having worked in the data industry, this sounds about right. Digital fingerprinting is certainly real, but I was way more paranoid about what I thought companies knew about me before working in the industry. the data quality across the board is dogshit. Even for the best companies doing B2B data like D&B and Zoominfo which are talked about as being better than most of the others - it's still mostly dirt. Data right n…
If you purchase a data source, how do you verify how good it is? Or do people typically just not do that?
Re: An incident impacting 5M accounts and private information on Twitter
#334Earlier quoted context omitted.
You know Google Authenticator is just an implementation of the TOTP open standard right? There are plenty of alternative apps that will give you the same number to key in...
If you’re on a Mac, in safari you can just right click on the QR code and set it up in keychain, then you can just auto fill from safari, no need for a third party app.
You might want to keep at least your email decoupled from a particular Hardware+OS+Browser combo.
Re: An incident impacting 5M accounts and private information on Twitter
#335Earlier quoted context omitted.
Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.
You know Google Authenticator is just an implementation of the TOTP open standard right? There are plenty of alternative apps that will give you the same number to key in...
I was very pleased to discover that most of the KeePass/KDBX apps (e.g. KeePassXC) also support storing this data and generating the TOTP.
Re: An incident impacting 5M accounts and private information on Twitter
#336Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
Maybe they should store salted hashes of phone numbers.
The purposes of phone numbers:
1. Verify you are a not a bot: no need to store anything except TRUE once verified.
2. 2FA - well use something better than SMS, but if you must, store the hash, and make me enter my number for the 2FA each time. Compare with hash and then send SMS.
Re: An incident impacting 5M accounts and private information on Twitter
#337>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.
I was just able to remove my phone number from my account settings and wandered into a Fred Sanford-level of junk data -- Twitter had me identified as a female (I'm male), had "interests" tied to me for both "Alexandria Ocasio-Cortez" and "Ben Shapiro" (they're most certainly not), and had my languages as "French" and "Indonesian" (I know only English). Bad digital hygiene.
Can you please identify the steps to get to these interest settings?
Re: An incident impacting 5M accounts and private information on Twitter
#338Anyone else annoyed by the growing use of the word "impact" to speak increasingly passively? People are so afraid to make a claim nowadays, even if it's obviously true. They speak of "impacts" or that something will be "impacted". But they seem to want to avoid saying who or what will be impacted. "I was impacted by today's layoffs." "We expect there to be impacts to website traffic." These meaningless words do nothi…
Head wobble
Re: An incident impacting 5M accounts and private information on Twitter
#339I believe this is the vulnerability reported to Twitter which awarded $5000 from its bug bounty program. https://hackerone.com/reports/1439026
Thanks for sharing this link. Twitter should've shared it in their post...
Re: An incident impacting 5M accounts and private information on Twitter
#340>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.
I have wanted to create a twitter a few times now, but they refuse to let me use my account/complete my signup until I give them my phone number.