7 ms·
I'll be interested to see the post-mortem on this breach for sure. As an outsider, I would have thought that the Twitter security team would have a set of high
by rtempaccount1 7y ago
I'll be interested to see the post-mortem on this breach for sure.
As an outsider, I would have thought that the Twitter security team would have a set of high-value users (with @jack being at the top of the list) who'd they keep very close tabs on in terms of any unusual activity.
Realistically Twitter is where announcements are made by world leaders and major corporations, control of these accounts could have repercussions, although in this case it just seems to have been a general hack...
- icanhasfay 7y agoI think most of the suspicions so far have been pointing to a sim swapping attack.
- rtempaccount1 7y agoHopefully if that's the case, more attention will be paid to the fact that using mobile phones for 2FA or identification on high value services is a bad idea :)
- mavhc 7y agoUsing phones is fine, using phone numbers is the problem. TOTP is great
- tomatocracy 7y agoUntil the authenticator app which holds the TOTP secrets in clear text is on the same phone as you are using to access the website/app in question to start with. Then you'd probably be better off instead storing a token in the secure enclave in the app itself instead.
- Mirioron 7y agoI don't understand why people do that. Your 2nd authentication factor should not be something relying on the same device that you're using.
- roywiggins 7y agoIt reduces the set of people who can access your account from "people with the password" to "people with the password and access to my phone." It's less like a 2nd factor and more like a poor man's password-protected private key authentication, but it's way better than just a password.
- jnbiche 7y agoTOTP is OK (probably would have been adequate for @jack). U2F is "great". TOTP can be phished, whereas U2F is virtually impossible to phish.
- harryh 7y agoI don't think "keep very close tabs on" can prevent an attack on an account before it happens. All it can do is help clean up the damage quickly. Which is what happened here. The offending tweets were deleted in 10-15 minutes. That's a pretty good response time. What could prevent an attack is limiting the features available to high-value users. One could imagine, for example, limiting 3rd party API access. Depending on what actually happened here, that might have prevented this. But there is a downside of reduced functionality for the owners of the accounts in question. There's always tradeoffs.
- rtempaccount1 7y agoI'd agree that there are always trade offs however, you could do a number of things to detect an active attack, changes in user agent, location etc can be detected and flagged for review. Now that's not possible at scale, but for high value users,it would seem like a not outrageous countermeasure.
- swyx 7y agothey've confirmed jack's SIM was hijacked. no amount of 3rd party API stuff canhelp there
- Nextgrid 7y agoWhy can his password even be reset remotely, and not something done by other company employees (HR, etc)? In an enterprise setting where people work in an office I don’t see the point of allowing self-service password resets. It opens you to huge risk for very little upside compared to having to physically walk into the office (if you aren’t there already) and have HR/line manager/etc do it for you.
- swyx 7y agoi mean its easy to say after the fact but i guarantee you most CEOs dont think to do this until theyve been hacked.
- harryh 7y ago
- riffic 7y ago>where announcements are made by world leaders and major corporations, control of these accounts could have repercussions That control should not be solely in Twitter's hands. Those leaders and orgs need to take a strong look at authenticity via ActivityPub self-hosted on their own namespaces.
- rtempaccount1 7y agoThat's a view for sure, however it seems that some world leaders and corporations have decided that the trade offs are worth the risk...
- reissbaker 7y agoSelf-hosting and security don't necessarily go hand-in-hand. For laypeople, self-hosting is usually worse: they don't know what threats to protect against, and even if they knew what to protect against they wouldn't know how. And Twitter is where the audience is.
- riffic 7y agoBy self-hosting I would propose the Gmail/G Suite model. Managed service but the organization controls users and the DNS.
- mlthoughts2018 7y agoThat’s not usually known as “self hosting”
- cameronbrown 7y agoNo but owning the namespace is important. It puts you, not Twitter, in the driver's seat.
- pjc50 7y agoJack's account is self-hosted on a website he runs. It just happens to be Twitter dot com.
- rajesh-s 7y agoI believe they do keep close tabs on high profile accounts. I happened to notice it in my feed when the news hadn't broken out yet (took a couple of screenshots out of surprise too). The team quickly took all of it down as and when they were being posted. It lasted for about 10minutes or so. The hackers were adding mentions to other accounts which were immediately suspended by the folks at Twitter too.
- sbassi 7y agoTop of the list should be all presidents, starting with the US.