4 ms·

We're talking about a security issue here, not regular support

kelnos 9y ago
It's not really a "security issue" in the way we think of them. This is just an -- optional -- security feature that isn't working, and as it turns out, not working on just one person's account. The OP shows that Twitter Security actually did investigate reasonably promptly, and replied that they couldn't repro the issue. And I think that's not unreasonable. The security team is mainly about triaging security vulnerabilities. They likely aren't equipped to deal with an issue that appears to be restricted to a single account, that's related to an optional feature. Now, Twitter's main-line support seems to be worse than useless, but I suppose that's to be expected, sadly.
- r3bl 9y ago
  > and as it turns out, not working on just one person's account. It's actually three. Three accounts, on three different browsers (Chromium, Firefox, Safari), using three different operating systems (Ubuntu, Windows, macOS). I was able to replicate it exactly as I've described every single time. They claim that they haven't. I'm in no position to try it with a larger number of accounts.
  - kelnos 9y ago
    And that's basically the worst thing to happen in any bug report scenario: unable to reproduce. Obviously we all want our support issues to get resolved in a positive manner, but sometimes it's not possible. And it's not like we're paying for Twitter, so they have no obligation to help us beyond what they think might make their actual paying customers unhappy. You may disagree with their math on this one, but it's their math to make.
- watter 9y ago
  So the feature is explicitly for security? Security feature. It is security for the user, not for the server. It is still security.
  - kelnos 9y ago
    I'm not saying it's the right way to do things, just that it's not unreasonable. Corporate infosec teams just usually aren't staffed to deal with this sort of issue. At best they can pass the user to regular support, or pass the issue on to whatever engineering team is responsible for third-party 2FA. And that's where the issue lies: if Twitter's regular support wasn't completely useless, we wouldn't have this problem here.

It's not really a "security issue" in the way we think of them. This is just an -- optional -- security feature that isn't working, and as it turns out, not working on just one person's account. The OP shows that Twitter Security actually did investigate reasonably promptly, and replied that they couldn't repro the issue. And I think that's not unreasonable. The security team is mainly about triaging security vulnerabilities. They likely aren't equipped to deal with an issue that appears to be restricted to a single account, that's related to an optional feature. Now, Twitter's main-line support seems to be worse than useless, but I suppose that's to be expected, sadly.

r3bl 9y ago
> and as it turns out, not working on just one person's account. It's actually three. Three accounts, on three different browsers (Chromium, Firefox, Safari), using three different operating systems (Ubuntu, Windows, macOS). I was able to replicate it exactly as I've described every single time. They claim that they haven't. I'm in no position to try it with a larger number of accounts.
- kelnos 9y ago
  And that's basically the worst thing to happen in any bug report scenario: unable to reproduce. Obviously we all want our support issues to get resolved in a positive manner, but sometimes it's not possible. And it's not like we're paying for Twitter, so they have no obligation to help us beyond what they think might make their actual paying customers unhappy. You may disagree with their math on this one, but it's their math to make.
watter 9y ago
So the feature is explicitly for security? Security feature. It is security for the user, not for the server. It is still security.
- kelnos 9y ago
  I'm not saying it's the right way to do things, just that it's not unreasonable. Corporate infosec teams just usually aren't staffed to deal with this sort of issue. At best they can pass the user to regular support, or pass the issue on to whatever engineering team is responsible for third-party 2FA. And that's where the issue lies: if Twitter's regular support wasn't completely useless, we wouldn't have this problem here.