5 ms·
Do they? There are usually levels of access and the bigger the change the more approval you need. Some things can only be done by an entirely separate team with
by manigandham 6y ago
Do they? There are usually levels of access and the bigger the change the more approval you need. Some things can only be done by an entirely separate team with manager sign off and other oversight.
It seems like Twitter has none of this, and while you can argue it's not the same a banking, there are still sensitive communications and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals.
- akersten 6y ago> and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals. Unless new information has emerged recently, this wasn't the attack vector. The attack was resetting account emails/passwords and turning off 2FA. I agree that there should have been more protections around this, but it's hardly newsworthy that Twitter employs a large support team to support their large userbase - my main gripe is with how the headline is framed.
- manigandham 6y agoThere's not much detail but how would they gain access from a password reset if they didn't have access to the email account? And if they had email access then they already have everything. The reset via admin tools must have bypassed the normal email workflow.
- SifJar 6y agoAdmin tools used to change account email address to one attacker controlled, then password reset requested which now sends to the attacker controlled email address
- manigandham 6y agoThen that's the vulnerable bypass. Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require several verification steps before it can be done.