4 ms·

> did the attackers see any of my private information? For the vast majority of people, we believe the answer is, no. This is such a weasel-y answer. “Yes, mos

by koluna 6y ago

> did the attackers see any of my private information? For the vast majority of people, we believe the answer is, no. This is such a weasel-y answer. “Yes, most of Earth’s population was not affected by this breach” - sure, but those that were affected, how would you be certain that they didn’t have their private information, such as DMs, pulled?

ezluckyfree 6y ago
That's kind of a cynical take. I parsed that statement as saying: > did the attackers see any of my private information? For the vast majority of people [who we previously mentioned were affected by this hack], we believe the answer is, no.
- sudosysgen 6y ago
  There is no indication that the accounts whose data was accessed were the accounts which tweeted the crypto scam. Therefore, I'm not sure that's a straightforward explanation.
  - andrewxdiamond 6y ago
    They say the attackers reset passwords on the accounts. Any competent engineering team would have a complete list of those events in logs
    - bhaak 6y ago
      You can't assume competence after such an hack. Before this has happened, you would have assumed that Twitter employees wouldn't fall for social engineering on this scale. I wonder especially how they could have bypassed their 2FA. Unless they specifically tell you something, you can't assume it to be the case.
- summitsummit 6y ago
  > That's kind of a cynical take. Disagree. The statement could be parsed more applicably as saying: > The most important question for people who use Twitter is likely — did the attackers see any of my private information? For the vast majority of people [who use Twitter], we believe the answer is, no.
XCSme 6y ago
Yes, I also thought that part is fishy. They also said "don't worry, no passwords were visible" (I don't think any tech person would expect them to store passwords in plain text), then continue saying that email address, phone number and possibly other personal info was accessible. So, the answer should be yes? Also, the initial question is about "me". I also never considered that my own data would have been accessible in this attack, I thought they would be discussing about the targeted accounts.
- PascLeRasc 6y ago
  They need to write this for their entire audience, most of whom has no idea what plain text even means. Also it was only a year ago that Facebook was found to have stored passwords in plain text so it's definitely a concern. Twitter has an excellent engineering blog so I'm looking forward to reading more technical details there if they publish any.

by koluna 6y ago

ezluckyfree 6y ago

That's kind of a cynical take. I parsed that statement as saying: > did the attackers see any of my private information? For the vast majority of people [who we previously mentioned were affected by this hack], we believe the answer is, no.

sudosysgen 6y ago
There is no indication that the accounts whose data was accessed were the accounts which tweeted the crypto scam. Therefore, I'm not sure that's a straightforward explanation.
- andrewxdiamond 6y ago
  They say the attackers reset passwords on the accounts. Any competent engineering team would have a complete list of those events in logs
  - bhaak 6y ago
    You can't assume competence after such an hack. Before this has happened, you would have assumed that Twitter employees wouldn't fall for social engineering on this scale. I wonder especially how they could have bypassed their 2FA. Unless they specifically tell you something, you can't assume it to be the case.
summitsummit 6y ago
> That's kind of a cynical take. Disagree. The statement could be parsed more applicably as saying: > The most important question for people who use Twitter is likely — did the attackers see any of my private information? For the vast majority of people [who use Twitter], we believe the answer is, no.

XCSme 6y ago

Yes, I also thought that part is fishy. They also said "don't worry, no passwords were visible" (I don't think any tech person would expect them to store passwords in plain text), then continue saying that email address, phone number and possibly other personal info was accessible. So, the answer should be yes? Also, the initial question is about "me". I also never considered that my own data would have been accessible in this attack, I thought they would be discussing about the targeted accounts.

PascLeRasc 6y ago
They need to write this for their entire audience, most of whom has no idea what plain text even means. Also it was only a year ago that Facebook was found to have stored passwords in plain text so it's definitely a concern. Twitter has an excellent engineering blog so I'm looking forward to reading more technical details there if they publish any.