12 ms·
On the Twitter Hack
- jacquesm 6y agoI would be highly surprised if world leaders communicated anything sensitive via DM on Twitter.
- Tenoke 6y agoWorld leaders maybe not but e.g. journalists almost definitely.
- jacquesm 6y agoHe specifically mentions world leaders. Also, tons of speculation in the article about things nobody is sure about yet and then extrapolating from there and proposing countermeasures that are off the scale. Security is important. But it wouldn't be the first time a communications service is hacked and assuming a nation state adversary you can consider every tech company in the world compromised to some degree by infiltrating employees into key positions. Those can play the long game and work at it for years to reach their destination. I would consider anything you entrust to a keyboard or some internet or wireless medium to be in principle compromisable, an in practice most likely compromised in the sense that people that should not have access to that data probably do.
- senectus1 6y agoNot good ones. I dont know many journo's but the ones i do know are Signal users.
- loriverkutya 6y agoI would be highly surprised if Trump didn’t.
- incanus77 6y ago> Just before the stroke of midnight on September 20, 2016, at the height of last year’s presidential election, the WikiLeaks Twitter account sent a private direct message to Donald Trump Jr., the Republican nominee’s oldest son and campaign surrogate. From https://www.theatlantic.com/politics/archive/2017/11/the-secret-correspondence-between-donald-trump-jr-and-wikileaks/545738/ https://www.theatlantic.com/politics/archive/2017/11/the-sec... Not directly a world leader, and even Trump Sr. was still the nominee, but not far removed from the scenario you describe.
- jacquesm 6y agoAnd that warrants breaking up or nationalizing Twitter how?
- jermier 6y agoMaybe not world leaders trading nuclear launch codes, but I imagine a fair bit of drug dealing goes down in Twitter's DM'osphere
- staycoolboy 6y agoKushner reportedly texted with MBS via WhatsApp: https://www.businessinsider.com/jared-kushner-reportedly-used-whatsapp-mohammed-bin-salman-2020-1 https://www.businessinsider.com/jared-kushner-reportedly-use...
- ac29 6y agoWhatsapp's messages are end to end encrypted, so in theory a compromised internal account wouldn't have access to the messages. Its backups aren't encrypted though.
- jsnell 6y ago> Companies like Facebook and Twitter have so much power because they are so large, and they face no real competition. I find it hard to take the rest of the article seriously when it's talking about Twitter as a giant monopoly that needs to be broken up... But also the argument seems fundamentally wrong. Account security is a prime example of a place where economies of scale bring a lot of benefit. I would absolutely trust the security of say Facebook, Google or Microsoft above that of Twitter just due to the larger scale. They can afford to spend more on security, since they have more users, and their users are more valuable. Every dollar spent on security applies to the whole user base. And similarly I'd trust Twitter above a 100 person web startup. If you start regulating for some kind of a minimum security bar, either you're going to be killing a lot of companies, or you're going to be setting the bar laughably low compared to what these companies already do. > Were there 100 different Twitter-like companies ... they would all be bankrupt.
- gargron 6y ago>> Were there 100 different Twitter-like companies >... they would all be bankrupt. Huh? There's over 2,000 Mastodon servers doing just fine
- tomphoolery 6y agomastodon servers aren't companies.
- gargron 6y agoSome of them are, some are not, as an end-user you don't know and it doesn't matter for the argument: That's over 2,000 organizations providing a Twitter-like service.
- SyneRyder 6y agoIn addition there's micro.blog, who seem to be doing okay with their paid-for Twitter-like micro blogging service. Though last time I looked in on it, they'd started interfacing with Mastodon as well.
- f38zf5vdt 6y agoGreat to see Schneier with a totally level-headed response in comparison to Krebs, who wrote a 5 page apparent doxxing of someone he maybe suspected could potentially have been the hacker. We have a standard (TLS) for general HTTP secure communications over the internet. We should also have standards for the transport and storage of user-to-user and user-to-public messages.
- jacquesm 6y agoYes, the level of class difference is substantial. Doesn't make this particular argument much stronger though. It also shows Schneier put in some actual thought before firing this off.
- skmurphy 6y agoCore argument is for "building codes" for software that is effectively mission critical infrastructure. Data and identify security--and privacy--concerns may drive a fair amount of regulation in the next five to ten years. Here is Schneier's core thesis: "There are many security technologies companies like Twitter can implement to better protect themselves and their users; that's not the issue. The problem is economic, and fixing it requires doing two things. One is regulating these companies, and requiring them to spend more money on security. The second is reducing their monopoly power. The security regulations for banks are complex and detailed. If a low-level banking employee were caught messing around with people's accounts, or if she mistakenly gave her log-in credentials to someone else, the bank would be severely fined. Depending on the details of the incident, senior banking executives could be held personally liable. The threat of these actions helps keep our money safe. Yes, it costs banks money; sometimes it severely cuts into their profits. But the banks have no choice. The opposite is true for these tech giants. They get to decide what level of security you have on your accounts, and you have no say in the matter. If you are offered security and privacy options, it's because they decided you can have them. There is no regulation. There is no accountability. There isn't even any transparency. Do you know how secure your data is on Facebook, or in Apple's iCloud, or anywhere? You don't. No one except those companies do. Yet they're crucial to the country's national security. And they're the rare consumer product or service allowed to operate without significant government oversight."
- d--b 6y agoThe comparison with banks is fair. I wonder if people can sue Twitter over this shit show.
- valuearb 6y ago“Those messages -- between world leaders, industry CEOs, reporters and their sources, heath organizations -- are much more valuable than bitcoin.“ If they had DN access, then those hackers were like a bumbling bank robbery gang who tunneled in during the medieval of night and ran off with all the pennies, leaving the paper money and safety deposit boxes unmolested.
- Aperocky 6y agoWhy would anyone message another on twitter with anything important though? Even if they really needed that contact info wouldn't they just use private messages to ask "what's your phone number"?
- valuearb 6y agoI’m sure that is true 98% of the time. But buried in the mass that is the other 2% are likely some messages that will be very valuable.
- jdkee 6y agoThis strikes me as particularly salient as to the point on privacy and security: "The opposite is true for these tech giants. They get to decide what level of security you have on your accounts, and you have no say in the matter. If you are offered security and privacy options, it's because they decided you can have them. There is no regulation. There is no accountability. There isn't even any transparency. Do you know how secure your data is on Facebook, or in Apple's iCloud, or anywhere? You don't. No one except those companies do. Yet they're crucial to the country's national security. And they're the rare consumer product or service allowed to operate without significant government oversight." Perhaps this hack will bring the security issue to the forefront of our U.S. legislators.
- sanderjd 6y agoI really feel like everyone is getting one of the broad points in this discussion wrong. If Twitter is a national security risk because people can hack it to speak in the official voice of prominent leaders, or discover state secrets through direct messages, that is nobody's fault but the government's, for relying on a platform they have no control over for official business. Can you imagine the military complaining that the enemy was able to give false orders or discover troop movements through messages on a privately owned communications network completely outside their control? No, because it would be absurd for the military to rely on such a network. It is no less absurd that the civilian government (which nominally has more power than the military) is doing so. It was a scandal when Hillary Clinton relied on a private email server. It is a far larger scandal that so many leaders, and especially the President, are now relying on a private company for their official communications.
- chasing 6y agoObviously government employees shouldn't be using Twitter DMs for unofficial business, but they're more or less required to use Twitter for communications with the public and fundraising. If they don't, they hand way too much of an edge to their competitors. The issue is that we don't want Donald Trump to mysteriously tweet "We're nuking Toronto this afternoon! #MAGA" and have a national security episode trying to figure out if it's a hacker or if he just saw something on Fox News that irked him.
- sanderjd 6y agoThey would not be "required" to use Twitter to keep up with their competitors, if they were all required not to use it for official communications. I'm not saying that politicians should choose to stop using Twitter for official communications, I'm saying Congress should pass a law requiring they not. I think there are already laws on the books around appropriate changes for official communications that could be augmented for this purpose.
- anonbcpolitics 6y ago> If Twitter is a national security risk because people can hack it to speak in the official voice of prominent leaders, or discover state secrets through direct messages, that is nobody's fault but the government's, for relying on a platform they have no control over for official business. I don't see the government relying on it. I see public officials using it as a platform. No coordination is being done (unless it's redundancy), just communication with constituents. > It was a scandal when Hillary Clinton relied on a private email server. One problem with using a private email server was because it circumvented FOIA requests. Twitter is open, a private email server is not. We still don't know what 33k of the subpoenaed emails were about that her personal IT guy deleted, other than the ones found on Huma Abedin's laptop. The other problem of course is having a personal IT staff run your email server with classified secrets (yes there were classified emails). It's not quite the same as having Twitter or the DoD run your security. I mean, the guy (stonetear) was on Reddit asking how to delete emails, I doubt he knew how to protect against state actors.
- perryizgr8 6y agoBreaking up monopolies like Twitter may not work. They must be subjected to heavy regulation. They must not censor/block/shadowban any account or tweet. They must open their entire operation to APIs at reasonable costs. They must allow interoperability with any other Twitter clone, tweets from everywhere should be visible across all Twitters. Follow all this, or pay $1M/day compounding fine.
- Thorrez 6y ago>It didn't matter whether individual accounts had a complicated and hard-to-remember password, or two-factor authentication. It didn't matter whether the accounts were normally accessed via a Mac or a PC. There was literally nothing any user could do to protect against it. Are we sure it didn't matter? 130 accounts were targeted, but attackers only got into 45 accounts. Maybe there was a security setting that stopped the attackers from getting into the other 85.
- Thorrez 6y ago>Were there 100 different Twitter-like companies, and enough compatibility so that all their feeds could merge into one interface, this attack wouldn't have been such a big deal. That has its own security downsides. Now attackers don't need to find vulnerabilities in 1 specific company, they can search across 100 different companies. And each one has much less revenue so a much smaller security team.