4 ms·

Is this interesting? Not a shit post question - do routine minor security breaches rise to the level of noteworthy these days?

dmitrygr 7y ago
It is karmic justice for yet another company that pushes SMS 2fa as "safe"
jordanpg 7y ago
That was my first thought too -- it seems profound, although it's difficult to articulate why. It's not like high-profile individuals have special security protocols available to them. Just the same password/2FA like the rest of us proles. On the other hand, it did make me consider that there are some accounts that could be compromised that would be very significant: Trump.
- beardog 7y ago
  Although technically available to anyone, Google has an "advanced protection program" for highly targeted accounts. It has the follow (may have missed some) effects on your account: * locked to 2fa with security keys * limiting the set of apps that can access account data * better scrutinized account reset - i assume this means it makes your account more resistant to phishing on Google employee's part. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ Its nice that Google apparently makes this available to anyone who is willing to buy the security keys. It would be nice if all major social media services had such a program.
  - drivebycomment 7y ago
    Yeah. At this point, any identity provider that doesn't support FIDO u2f is either incompetent or negligent or both.
  - hermitdev 7y ago
    Not sure if this falls into the advanced protection for Google, but about a year or two ago, got a notification of a suspicious login from Moscow (I'm from the US and have never travelled out of North America). Promptly changed my password.
- perl4ever 7y ago
  "there are some accounts that could be compromised that would be very significant" Trump? I'm not really being facetious when I ask what difference it could possibly make. Of course, sometimes his tweets do appear to move the stock market, but still.
saagarjha 7y ago
This isn't a "routine minor security breach".
- peterwwillis 7y ago
  Did all of Twitter get hacked, or did a single user get embarrassed?
zacwebb 7y ago
I'd say influential figures (i.e. the CEO of the platform) having their accounts hacked and posting bomb threats is considered noteworthy...
atemerev 7y ago
It is. The consequences of hacking e.g. @RealDonaldTrump would be disastrous (especially if the adversary is a hostile nation state whose hackers are smart enough to make plausible, but damaging statements).
- ben_w 7y ago
  Would it, in that particular case? Don’t get me wrong, I agree with your general point (imagine a police department account tweeting a photo of someone while accusing them of a crime), but given the Tweets of his that people quote I get the impression that even if Trump’s account posts open declarations of war nobody would do anything?
  - cookie_monsta 7y ago
    Agreed. Trump's Twitter account is a bad example of things that people read that might have real world consequences.
    - AaronFriel 7y ago
      https://www.mediaite.com/online/pentagon-reportedly-feared-trumps-transgender-ban-tweet-was-announcement-of-north-korea-strike/ https://www.mediaite.com/online/pentagon-reportedly-feared-t... The official policy of the White House is that the President's tweets from @realDonaldTrump can be statements of the President in his official capacity, and therefore binding to the extent that any Presidential order or command can be. He has fired people, he has announced sweeping policy changes, made nominations, and so on through Twitter, which have then been acted on by the executive branch, Congress (which held appointment hearings for a SecDef before a formal nomination, but after a tweet), and the courts.
      - cookie_monsta 7y ago
        Of course that's the nod nod wink wink official policy - how could it be otherwise, and with any other president you would be wise to attach some weight to presidential tweets. But here's the only test you have to make: would you take real-life, consequential action based solely on a Trump tweet or would you look for verification elsewhere first? Because if it's the latter, it doesn't really matter if Trump's account gets hacked.
lozaning 7y ago
If someone got into Zuck's facebook account I'd be interested in knowing.

dmitrygr 7y ago

It is karmic justice for yet another company that pushes SMS 2fa as "safe"

jordanpg 7y ago

That was my first thought too -- it seems profound, although it's difficult to articulate why. It's not like high-profile individuals have special security protocols available to them. Just the same password/2FA like the rest of us proles. On the other hand, it did make me consider that there are some accounts that could be compromised that would be very significant: Trump.

beardog 7y ago
Although technically available to anyone, Google has an "advanced protection program" for highly targeted accounts. It has the follow (may have missed some) effects on your account: * locked to 2fa with security keys * limiting the set of apps that can access account data * better scrutinized account reset - i assume this means it makes your account more resistant to phishing on Google employee's part. https://landing.google.com/advancedprotection/ https://landing.google.com/advancedprotection/ Its nice that Google apparently makes this available to anyone who is willing to buy the security keys. It would be nice if all major social media services had such a program.
- drivebycomment 7y ago
  Yeah. At this point, any identity provider that doesn't support FIDO u2f is either incompetent or negligent or both.
- hermitdev 7y ago
  Not sure if this falls into the advanced protection for Google, but about a year or two ago, got a notification of a suspicious login from Moscow (I'm from the US and have never travelled out of North America). Promptly changed my password.
perl4ever 7y ago
"there are some accounts that could be compromised that would be very significant" Trump? I'm not really being facetious when I ask what difference it could possibly make. Of course, sometimes his tweets do appear to move the stock market, but still.

saagarjha 7y ago

This isn't a "routine minor security breach".

peterwwillis 7y ago
Did all of Twitter get hacked, or did a single user get embarrassed?

zacwebb 7y ago

I'd say influential figures (i.e. the CEO of the platform) having their accounts hacked and posting bomb threats is considered noteworthy...

atemerev 7y ago

It is. The consequences of hacking e.g. @RealDonaldTrump would be disastrous (especially if the adversary is a hostile nation state whose hackers are smart enough to make plausible, but damaging statements).

ben_w 7y ago
Would it, in that particular case? Don’t get me wrong, I agree with your general point (imagine a police department account tweeting a photo of someone while accusing them of a crime), but given the Tweets of his that people quote I get the impression that even if Trump’s account posts open declarations of war nobody would do anything?
- cookie_monsta 7y ago
  Agreed. Trump's Twitter account is a bad example of things that people read that might have real world consequences.
  - AaronFriel 7y ago
    https://www.mediaite.com/online/pentagon-reportedly-feared-trumps-transgender-ban-tweet-was-announcement-of-north-korea-strike/ https://www.mediaite.com/online/pentagon-reportedly-feared-t... The official policy of the White House is that the President's tweets from @realDonaldTrump can be statements of the President in his official capacity, and therefore binding to the extent that any Presidential order or command can be. He has fired people, he has announced sweeping policy changes, made nominations, and so on through Twitter, which have then been acted on by the executive branch, Congress (which held appointment hearings for a SecDef before a formal nomination, but after a tweet), and the courts.
    - cookie_monsta 7y ago
      Of course that's the nod nod wink wink official policy - how could it be otherwise, and with any other president you would be wise to attach some weight to presidential tweets. But here's the only test you have to make: would you take real-life, consequential action based solely on a Trump tweet or would you look for verification elsewhere first? Because if it's the latter, it doesn't really matter if Trump's account gets hacked.

lozaning 7y ago

If someone got into Zuck's facebook account I'd be interested in knowing.