14 ms·
From Twitter's statement: > People who did not have this setting enabled or do not have a phone number associated with their account were not exposed by this v
by sakisv 7y ago
From Twitter's statement:
> People who did not have this setting enabled or do not have a phone number associated with their account were not exposed by this vulnerability.
This is a bit disingenuous, given that you can't really open an account unless you provide a phone number to "verify" it.
Edit for clarification:
As gojomo said below (https://news.ycombinator.com/item?id=22233612 https://news.ycombinator.com/item?id=22233612) you may not need to provide it during sign-up, but your new account is almost immediately locked for "suspicious activity" and you need to provide a phone to unlock.
- kjaftaedi 7y agoThat might be the case now, but twitter didn't always require them. I wouldn't be surprised if there are 10s of millions of accounts without phone numbers associated with them.
- deleted 7y ago[deleted]
- atomi 7y agoThey "requested" my phone number after the fact. And by "requested" I mean I wasn't exactly given a choice. I wasn't able to access my account until I provided a number. Of course all this was for "security" reasons. Personally I'd prefer to use Google authenticator anyway.
- SkyBelow 7y agoI feel as if one of the many elephants being overlooked here is how 'security' is being abused to further data collection. When an account gets locked now, I don't think it is for actual security, but to increase data collection. Tragedy of the commons being exploited by major websites. The same ones which also want to hold themselves as the arbiter of truth (or at least as one of the Arbiter's official spokesmen).
- cmroanirgo 7y agoI just checked the twitter signup form, which does have a phone input. But there's a toggle saying "use email instead". So, no phone number is required.
- deleted 7y ago[deleted]
- gojomo 7y agoNew accounts without an associated phone number tend to face a lock & challenge, for "suspicious activity" (even if they've never posted), which can only be reversed by adding a phone number. So, Twitter is de facto requiring phone numbers on many more accounts than the initial sign-up flow might indicate – to the detriment of user privacy, & increasing the damage of compromises like this one.
- tialaramex 7y agoNote that activities which are potentially suspicious aren't just about posting, it includes following people, because that makes their follower count go up, and the whole point of displaying that count is most people want to appear popular - and so of course people create bogus followers. I agree that Twitter using this to get people to give them PII those don't want Twitter to have, especially when Twitter aren't a good custodian of that PII is terrible, but it's not as though Twitter's other option (anybody can mint a thousand bogus Twitter followers with no pushback from Twitter) looks great either.
- gojomo 7y agoYes, Twitter now considers everything "suspicious", including the minimal steps required to use Twitter as a logged-in account at all, like "following people" (even just a few). And thus, Twitter more-or-less requires phone numbers from everyone. This increases the risk that Twitter's users will be "doxxed" – and even, when those users anger certain large violent organizations, the risk they'll be assassinated.
- jammygit 7y ago
- raxxorrax 7y agoThe whole phone number thingy for added security 2 factor auth has been quite the scam.
- pingyong 7y agoWhy wouldn't you though, that's gotta be pretty juicy data. You can compare phone numbers across so many different databases now, makes profile creation 10x more efficient. Not really surprising that everyone wants your phone number badly these days. Microsoft does the same thing btw. Was really fun for a friend of mine who registered a Microsoft account for mixer, forgot about, bought Halo, needed an MS account to log in, thought hey I already have one, and instantly got locked out because it didn't have a phone number.
- captn3m0 7y agoI bought a dress, a cookie, and a book yesterday from a mall in India. All 3 asked me for my phone number. It’s getting ridiculous
- andrewzah 7y agoDo you put your real number in for those kinds of purchase? I generally just put in a random 800- number.
- captn3m0 7y agoI just say "No, thanks" with a smile.
- lonelappde 7y agoDoesn't India link phone numbers to bank accounts?
- OJFord 7y agoAs I've understood it, it's more like you can charge (some things) to your phone bill. Like buying ringtones/apps for 00's phones, but not just phone-related purchases.
- the8472 7y agoInstead of providing a phone number you can also email support and complain about the account lock. But yeah, it's a pretty scummy bait and switch behavior.
- notrandom 7y agoI personally tried this. Pregnant silence.
- rahuldottech 7y agoI had to send at least six emails to get this to work. Six.
- dicytea 7y agoDoes this vulnerability affect people who added a phone number but then removed them? Last time I tried, this method was effective for getting around the "suspicious activity" lock.
- caseysoftware 7y agoEven if you disconnect the number, they still keep it on file. I have a small network of legitimate accounts that they've suspended a few times. In this last round of suspensions, I can't reset any of them with my phone numbers any more.
- JaRail 7y agoNo, it wouldn't work. It only works if people can discover you with the "find people you know from your address book" feature. A deleted number won't match. Or you can just turn it off in your discoverability settings.
- jchw 7y agoIndeed: using email based sign up usually immediately triggers a suspension. It can take as little as a few minutes.
- sf_rob 7y agoMy account was locked, I never sent a single tweet or even followed anyone, just refused to provide them more information about myself.
- Polylactic_acid 7y agoSame, looks like twitter just locks any account that isn't active enough for some reason.
- JaRail 7y agoSo people don't generate thousands of accounts then sit on them until they want to spam with legit-looking seven year old accounts.