3 ms·
This sounds like an incredible fuckup by Twilio. If it's true that their authentication verification was the entrypoint, they could be liable for leaking an en
by bpodgursky 6y ago
This sounds like an incredible fuckup by Twilio. If it's true that their authentication verification was the entrypoint, they could be liable for leaking an enormous amount of personal information.
- fredley 6y agoIt's hard to tell. It could be that Parler's systems were set up to just fail the wrong way if the Twilio auth system didn't respond (on error: allow). Whatever the case, this is going to be 'fun' to watch.
- mabbo 6y agoNot necessarily. See my other comment on this thread, but they may have failed-open when the OTP authentication dependency was down- ie, hey, Twilio throws an exception sometimes so presume the user is approved so we don't impact the user experience due to Twilio being flakey.
- marcinzm 6y agoHow so? Twilio simply suspended service which they are allowed to do based on the ToS. It was Parler that reacted to it by allowing unrestricted authentication rather than simply failing authentication.
- ceejayoz 6y agoNo, it'd be a fuckup by whoever code it to go "if Twilio is unavailable, just let them in". It's highly unlikely Twilio's API responds with something like {"authenticated": true} when you haven't paid your bill or they suspend you.
- mStreamTeam 6y agoThis loooks serious. I might have to start looking into Twilio alternatives form my company. Does anyone have any suggestions?
- simlevesque 6y agoIf you read what happened you'd know that this could never happen if they built their system with the minimum care required. Twillio is absolutely not the culprit.
- holtalanm 6y agoI'm highly doubting Twilio is the culprit here. Sounds like Parler was just treating failures as valid authentication. Keep in mind that at the time the hackers gained access, Twilio had already suspended Parler's account, so there is little to no possibility of this being on Twilio's shoulders.
- deleted 6y ago[deleted]
- bearjaws 6y agoHard to understand exactly what happened, but seems like a faulty implementation of Twillio's authy service.
- willis936 6y agoHow is this Twilio’s doing? Parler was not a customer when this happened. This was Parler being held together by duct tape and not having choices. This is what happens when a young and populated site dependent on services loses all of said services. That is to say: you are a fool to trust websites, especially Parler.
- goodluckchuck 6y agoI think that depends on Twilio's knowledge and intent. If the specific purpose for suspending services was to allow unauthorized access, that's conspiracy. It'd be as if a bank's security guard quit and walked off the job the day of a bank heist. He has the right to quit, but not a right to coordinate with the robber and leave his post for the purpose of assisting in illegal activity.
- willis936 6y agoThe latter is also conspiracy, and a stretch at that. What would Twilio gain? The most likely explanation was that everyone ditched Twilio as a customer and the remaining skin was quickly pecked off by vultures.