4 ms·
Parler user data exposed and exfiltrated
- qntmfred 6y agoNo way in hell I download that.
- dehrmann 6y agoOne: it's super illegal. Two: didn't we just learn our collective lesson about doing illegal things just because we think they're for the greater good? I won't wade into if wide-scale hacking and doxing is better or worse than storming the capitol, but they're both pretty far down the path of the end justifies the means.
- basdftrewq 6y agoSo was Parler was just a honeypot for the incoming domestic "war on terror"?
- swivelmaster 6y agoI doubt it. There's a long history of self-important "we're going to create an alternative to X social media site/service, but with FrEe sPeEch!!!" sites built by largely incompetent grifters.
- basdftrewq 6y agoThe mandatory phone and required ID for some features according to the reply below (wtf?) sound really weird.
- CyanLite4 6y agoYes. You had to take a picture of a government ID in order to get certain user privileges.
- onion2k 6y agoParler's origin story can be summarised as: - Former startup founder and Amazon dev meets beautiful Russian woman in Vegas - Whirlwind romance - Married in Russia - Travels Russia for 6 months allegedly having meetings with tech people and lawyers - Comes back to Vegas and starts social network with 'secret' (eg not publicly disclosed) investors. None of that is necessarily a smoking gun. It could be entirely legitimate and above board, and just the story of how someone started a business that's right on the edge of what's socially acceptable for many people. But if you wanted to build a honeypot social network in the USA that is pretty much exactly how you'd do it.
- ampdepolymerase 6y agoCan Twilio be held liable and sued?
- Grimm1 6y agoI have it on good authority that the post is largely incorrect and that the Android app had been reverse engineered but nothing beyond that. Edit: A quote on the matter from my friend working to archive the content, "so tldr if you care/want to share on HN: the android app either used or had references to an api endpoint which let you transform a sequential id into the uuids that are used on the other endpoints. someone enumerated that." "afaik that's literally it" Further Edit: https://github.com/d0nk/parler-tricks https://github.com/d0nk/parler-tricks is what they're using to enumerate the resources
- whymauri 6y agoAny more details? I know one major red flag for me was all the verification Parler was requesting. SSNs, and all that. There's no way that can end well.
- Grimm1 6y agoI know someone working to archive Parlers content on the archive team, but everything being downloaded is publicly available urls.
- SubiculumCode 6y ago"I have it on good authority" that's some grade-A trolling right there. Congrats. All the Qanon et al.posts start the same way. i.e. I have it on good authority that....X will happen by Y tonight. blah blah blah. The storm.
- Grimm1 6y agoNo idea what you're on about, I just know a guy working on https://www.archiveteam.org/ https://www.archiveteam.org/
- SubiculumCode 6y agoPlease accept my apology. I had been perusing the crazy on Parler to get an idea of what is going around there, and it put me in a bit of a foul mood.
- sb057 6y ago>I am positive the FBI has been actively soaking in this information along with the Internet Warriors, but this is how they are going to officially track down. Would that not be massively unconstitutional? Surely law enforcement isn't allowed to use illegally-obtained records?
- eyelidlessness 6y agoOh, I see you’ve never heard of the FBI.
- swivelmaster 6y agoFBI has taken over dark web porn sites (I shouldn't have to explain what that means) and used them as honeypots for months before making arrests. It's a pretty common tactic.
- DaiPlusPlus 6y agoYes and no. It's inadmissable in court, but that data can be legally used as tips, leads and to inform an investigation for more legal data collection avenues: it's called Parallel Construction: https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction An example would be a police tip phone-number: it's all hearsay (unless it's a confession) and largely cannot be admitted into court directly, but it definitely leads to collecting solid evidence later on by investigators who can get warrants.
- Gibbon1 6y agoThe FBI doesn't just up and tell people when it gets a warrant. They only have to disclose if they prosecute. And even then often not. At this point were in national security letter territory.
- imperio59 6y agoThere's a difference between allowed to use to investigate and allowed to use in court as valid evidence if it was not properly acquired with a valid warrant. The issue is that 97% of all federal court cases are settled before trial and never reach that stage because people often admit guilt and take a plea deal and don't know their own rights. Also relevant: https://youtu.be/d-7o9xYp7eE https://youtu.be/d-7o9xYp7eE
- judge2020 6y agoThe description of a "warrier" used to download parler files is currently what the Archive Team is doing to download parler content (not sure if AT's warrier image is specifically what they're referring to). https://archiveteam.org/index.php?title=Parler https://archiveteam.org/index.php?title=Parler https://tracker.archiveteam.org/parler/ https://tracker.archiveteam.org/parler/
- crowf 6y agoso they are called hackers when they are attacking something "good" and internet warriors when they are attacking something "bad"?
- eyelidlessness 6y agoMy goodness it’s a good thing you don’t freely associate with a site called Hacker News.
- glasss 6y agoSounds almost as conspiracy theory-esque as some posts you'll find on parler or other corners of the internet. Would like to see some proof or screenshots as least. That might make a facebook post worthy of posting to HN. Edit: I Read the posts from the relevant twitter account which shared some screenshots. Some of the lines from this facebook post other twitter posts are I think still a bit of stretch / speculation, but it definitely seems parler's data has been lifted by a number of parties.
- elicash 6y agoAnd the entire post is in quotation marks, without it being clear what the person is quoting. I guess they're quoting this twitter account? https://twitter.com/donk_enby https://twitter.com/donk_enby
- Barrin92 6y agothe data is available on the twitter account linked in the article including screenshots of internal moderation tools. Seems real enough. edit: not sure about the no-fly stuff, that may as well be made up
- glasss 6y agoI did not see a link, but I do see the Twitter screenshots at the bottom. I don't have a Facebook so maybe I can't see links in the post. Could you post the relevant link? Edit: I have now seen the Twitter account and relevant screenshots / posts, thank you for making me take another look
- afuchs 6y agoFor those curious: https://twitter.com/donk_enby/status/1346536580295626754 https://twitter.com/donk_enby/status/1346536580295626754 It looks like they're reverse engineering an iOS app
- whymauri 6y agoThis reads like hackerman fan fiction. Not sure if I buy it. Is there a better source? Edit: OK, I just read the Twitter feed of the poster in the screenshot. This is a massive misinterpretation of what the archivists are doing. They're doing an archival web crawl and sharing a docker image for volunteers.
- Grimm1 6y agoExactly, as my friend working with the archivists has been telling me.
- deleted 6y ago[deleted]
- robbiep 6y agoImagine using incremental counts as a file name for all your received files in this day and age
- r721 6y agoSee also this pre-print: https://twitter.com/iDRAMALab/status/1347280648915062787 https://twitter.com/iDRAMALab/status/1347280648915062787
- RcouF1uZ4gsC 6y agoAs Charles Barkley advised earlier: ‘If you’re going to break the law, do not write a check’ If you are going to plan a coup, don’t register your phone number and upload a copy of your Drivers License with your photo, name, and address. This is probably the most incompetent insurrection since the Whiskey Rebellion.
- pmontra 6y agoIs that hacking, downloading and archiving legal in the USA? I expect it to break a lot of laws in my country. But impressive technical feat. I'd like to understand what exactly Twilio disclosed in their press release, to be able to secure a service if that information is disclosed about a service of mine.
- inglor_cz 6y agoSo, is the next step an easily searchable database of all the users who commented, together with all the comments, including deleted ones? (That would be against GDPR in the EU, but probably not against US law.) Would that be a good thing, a bad thing or something in between?