4 ms·
> and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals. Unless new information has emer
by akersten 6y ago
> and there's no real reason why anyone should be able to post new tweets or access private messages without several approvals.
Unless new information has emerged recently, this wasn't the attack vector. The attack was resetting account emails/passwords and turning off 2FA.
I agree that there should have been more protections around this, but it's hardly newsworthy that Twitter employs a large support team to support their large userbase - my main gripe is with how the headline is framed.
- manigandham 6y agoThere's not much detail but how would they gain access from a password reset if they didn't have access to the email account? And if they had email access then they already have everything. The reset via admin tools must have bypassed the normal email workflow.
- SifJar 6y agoAdmin tools used to change account email address to one attacker controlled, then password reset requested which now sends to the attacker controlled email address
- manigandham 6y agoThen that's the vulnerable bypass. Changing the email is effectively changing the identity attached. It's akin to an account recovery and should require several verification steps before it can be done.