471–479 of 479 posts
Earlier quoted context omitted.
What percent of mobile numbers do you think are associated with twitter accounts? I don’t know, but it wouldn’t surprise me to find out they had to try 500M or more numbers to find 5M accounts.
We'd need to actually test it. But I believe the finding ratio would be even lower than 1 in 100.
[1] https://www.bleepingcomputer.com/news/security/twitter-revea...
Earlier quoted context omitted.
And making sure constant time on the response. Otherwise the slower response likely corresponds to a real phone number if the backend synchronously did more actions, such as sending a recovery email. The backend would need to be really slow however in order for a strong enough signal for this to be useful.
Still it’s so much better to have the binary information of whether or not an account exists with that information than exactly which account it is.
Earlier quoted context omitted.
Authy is a TOTP app.
Ah, i thought Authy was a service. So.. why can't OP use Authy with Google? Google Auth is just TOTP, yet Authy is not capable of using it somehow? I'm so confused lol. I've used plenty of TOTP apps with Google.
Earlier quoted context omitted.
They also refuse voip numbers. I am now at 20 back and forth emails with Discord support explaining I do not own a cell phone. They are seriously suggesting I buy one just to use Discord.
Maybe there needs to be some sort of law that prohibits this sort of thing. In the meantime, Discord has been added to my "do not recommend" list.
Earlier quoted context omitted.
I signed up for twitter a couple weeks ago to follow some ukraine folks. They didn't require a phone number and just double checking my account doesn't have one.
They require it most of the time, and not always at first. Do anything remotely controversial, like retweeting a non-conformist, and they likely will.
Earlier quoted context omitted.
They require it most of the time, and not always at first. Do anything remotely controversial, like retweeting a non-conformist, and they likely will.
I spent years being extremely controversial on twitter. Account is still active and does not have a phone number linked.
Earlier quoted context omitted.
You can if the hash collides within the IPv4 address space; ie it's a hash of less than about 16 bits. Enough to let your roughly see if something fishy is going on but you can't reverse engineer to any specific IP, only a set of 64 thousand.
That isn't good enough. By taking that hash and old request data combined with your current request logs it's enough to de-anonymization a significant portion of those logs making you not in compliance.