4 ms·
I don't think "keep very close tabs on" can prevent an attack on an account before it happens. All it can do is help clean up the damage quickly. Which is what
by harryh 7y ago
I don't think "keep very close tabs on" can prevent an attack on an account before it happens. All it can do is help clean up the damage quickly. Which is what happened here. The offending tweets were deleted in 10-15 minutes. That's a pretty good response time.
What could prevent an attack is limiting the features available to high-value users. One could imagine, for example, limiting 3rd party API access. Depending on what actually happened here, that might have prevented this. But there is a downside of reduced functionality for the owners of the accounts in question. There's always tradeoffs.
- rtempaccount1 7y agoI'd agree that there are always trade offs however, you could do a number of things to detect an active attack, changes in user agent, location etc can be detected and flagged for review. Now that's not possible at scale, but for high value users,it would seem like a not outrageous countermeasure.
- swyx 7y agothey've confirmed jack's SIM was hijacked. no amount of 3rd party API stuff canhelp there
- Nextgrid 7y agoWhy can his password even be reset remotely, and not something done by other company employees (HR, etc)? In an enterprise setting where people work in an office I don’t see the point of allowing self-service password resets. It opens you to huge risk for very little upside compared to having to physically walk into the office (if you aren’t there already) and have HR/line manager/etc do it for you.
- swyx 7y agoi mean its easy to say after the fact but i guarantee you most CEOs dont think to do this until theyve been hacked.
- harryh 7y agoIt's the same idea though: they could turn off posting via SMS for high value accounts.
- swyx 7y agono once they pwn your number its a 2FA vector so they get full control