4 ms·
Interesting to hear they “got access to the Twitter credentials when [they] found a way into Twitter’s internal Slack messaging channel and saw them posted ther
by boogies 6y ago
Interesting to hear they “got access to the Twitter credentials when [they] found a way into Twitter’s internal Slack messaging channel and saw them posted there”. I wonder if using a free-as-in-freedom alternative like Zulip (on the front page yesterday), Mattermost (closer alternative, whose website https://mattermost.com/ https://mattermost.com/ emphasizes security), or Matrix (also seems popular on HN) would have prevented the hack.
- trhway 6y agoit doesn't matter. The main point is the apparent security [mis]architecture at Twitter such that those posted credentials is enough to get access. It means no 2FA, the bare minimum for prod access. It probably also means no role based access control (or such an ugly one that instead of roles assigning/modifying/etc. people resort to posting/sharing credentials of critical prod accounts).
- boogies 6y agoI'm not trying to say that the communication platform is the most important factor, but I don't see how it hurts to pose a question about it.