Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

341–350 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#341
post #333

Earlier quoted context omitted.

having worked in the data industry, this sounds about right. Digital fingerprinting is certainly real, but I was way more paranoid about what I thought companies knew about me before working in the industry. the data quality across the board is dogshit. Even for the best companies doing B2B data like D&B and Zoominfo which are talked about as being better than most of the others - it's still mostly dirt. Data right n…

If you purchase a data source, how do you verify how good it is? Or do people typically just not do that?

you can verify how full it is.

there are some verification focused services - like they take a list of emails and check if they are valid email addresses. Some use fine print to say they are only validating whether or not it is of valid email address FORMATTING, and make no claim about whether or not the email will bounce. verifying if the email address actually belongs to the person it claims to is not part of the deal.

it's nearly an impossible task, because you have no actual source of truth to verify it against. So data vendor A and B give you different results for the same search - now what? you have to manually research and see whos "right" or "more recent".

even if it looks like good data, it might be stale. For example, company size, revenue, C level email addresses, etc all change over time.

so if a customer wants cleaner data - you basically charge them to pump the dataset through Mechanical Turks or upwork or something to have people try to verify things manually. Datasets can be large though and this gets expensive, so it tends to be better to just buy the crap data for cheaper and figure it out yourself

I have a conspiracy theory that these verification services are behind a lot of the phone spam today. they are just checking if your phone number is valid, they dont actually care if you answer.

Re: An incident impacting 5M accounts and private information on Twitter

#342

Perhaps Twitter needs to make it easier to create accounts anonymously and stop virtue signaling (i.e suspend accounts created over Tor onion-service) With pseudonymous usage of public services information minimisation to maintain operational-security against private user-data being disclosed by external hackers or rogue insiders is a mantra that needs to be followed religiously.

I’m six months in and they haven’t asked for a phone number yet. I dread the day when they do. This is where proficiency in the Twilio API comes in handy.

Lucky you. I can't create another twitter account as my number is on a network unreachable by their SMS system. Worst of both worlds for me as when that number was on another network they could verify. So leaked number that I cannot even use to verify a second business account :-(.

Re: An incident impacting 5M accounts and private information on Twitter

#344

>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.

I have wanted to create a twitter a few times now, but they refuse to let me use my account/complete my signup until I give them my phone number.

I've also wanted to join Twitter a few times now, but every time I visit, they quickly let me forget what that reason might have been

Re: An incident impacting 5M accounts and private information on Twitter

#345
post #259

Earlier quoted context omitted.

I have 100% seen this happen.

really? what do you mean 'middle management is trained to keep that from getting to the top'? intentional malfeasance? where I work people are trying their best but dealing with complex systems, memories, and methods of communication. because of this, security issues are sometimes missed, sometimes poorly communicated, and sometimes poorly remediated.

Probably not 'trained' as much as 'heavily incentivized'. Nobody wants to be the messenger that gets shot for bringing bad news. Much easier to cover up and tell the big boss what they want to hear as long as you can.

Re: An incident impacting 5M accounts and private information on Twitter

#346
post #259

Earlier quoted context omitted.

I have 100% seen this happen.

really? what do you mean 'middle management is trained to keep that from getting to the top'? intentional malfeasance? where I work people are trying their best but dealing with complex systems, memories, and methods of communication. because of this, security issues are sometimes missed, sometimes poorly communicated, and sometimes poorly remediated.

It means silos and information hiding are baked in — as a matter of corporate culture — at least in part to preserve the option of plausible deniability for statements like Twitter’s.

Re: An incident impacting 5M accounts and private information on Twitter

#347

Earlier quoted context omitted.

I was just able to remove my phone number from my account settings and wandered into a Fred Sanford-level of junk data -- Twitter had me identified as a female (I'm male), had "interests" tied to me for both "Alexandria Ocasio-Cortez" and "Ben Shapiro" (they're most certainly not), and had my languages as "French" and "Indonesian" (I know only English). Bad digital hygiene.

having worked in the data industry, this sounds about right. Digital fingerprinting is certainly real, but I was way more paranoid about what I thought companies knew about me before working in the industry. the data quality across the board is dogshit. Even for the best companies doing B2B data like D&B and Zoominfo which are talked about as being better than most of the others - it's still mostly dirt. Data right n…

> data vendors are financially incentivized to make shit up about you as much as they can get away with

Exactly this. But they can get away with basically anything. Worst case for them is they show you a premium ad you aren’t interested in. Best case is they guess correctly

Re: An incident impacting 5M accounts and private information on Twitter

#348

>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.

I just have a physical burner phone for all this nonsense. Costs like $15 bucks and totally worth the tiny investment.

Re: An incident impacting 5M accounts and private information on Twitter

#349

Earlier quoted context omitted.

They said don't add a publicly known phone number to your account, so you have to create a Google Voice account that you'll never use except for account credentials like this. But Twitter will probably ban you for not using a real phone number. Or, you'll reuse that phone number across other accounts until one of them gets hacked and that phone number sold on the dark net, and now it's a public phone number again.

Last time I tried (last year), Twitter did not accept VoIP numbers. I tried Google Voice and Sudo (which are provisioned by Twilio).

>Last time I tried (last year), Twitter did not accept VoIP numbers

If only my phone company also had this policy!

Re: An incident impacting 5M accounts and private information on Twitter

#350

>To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.

I was just able to remove my phone number from my account settings and wandered into a Fred Sanford-level of junk data -- Twitter had me identified as a female (I'm male), had "interests" tied to me for both "Alexandria Ocasio-Cortez" and "Ben Shapiro" (they're most certainly not), and had my languages as "French" and "Indonesian" (I know only English). Bad digital hygiene.

I don’t even know how an algorithm can tie someone to AOC and Ben Shapiro at the same time. What on earth are you browsing.
Post reply on HN