13 ms·
This story truly terrifies me: my team owns my company's sign up page. (I speak for myself and not them, of course). Sounds like Parler, fearing that their OTP
by mabbo 6y ago
This story truly terrifies me: my team owns my company's sign up page. (I speak for myself and not them, of course).
Sounds like Parler, fearing that their OTP provider might go down, decided to fail-open, ie: if the dependency throws an exception, presume there's something wrong with the dependency and that the code provided is acceptable. It never occurred to them that the dependency could be down permanently, or that malicious actors[0] would be able to realize it and exploit to quickly.
Lesson learned: do not fail open where security matters, where authentication matters. Failing closed prevents new users/customers from signing up, but it protects your existing users/customers.
[0]From a security standpoint, these are malicious actors. I would also probably buy said malicious actors a beer if I met them, accompanied by a high five.
Edit: this is a hypothesis of course. Maybe the bug was somewhere else in the system- it could be in Twilio's provided integration library where the fail-open occurred.
- user-the-name 6y agoPretty clear where their priorities lay, huh. Breaking the security of their users is less important than getting new users.
- simlevesque 6y agoExtreme growth hacking
- Cthulhu_ 6y agoYeah, just open the flood gates to bots. Twitter would be 100x as large now. Wasn't it something like 99% of e-mail was spam? The downsides of an open / decentralized platform.
- amanaplanacanal 6y agoMaybe we should stop idolizing free speech, and instead work towards inexpensive speech :)
- swiley 6y agoOf course, they couldn't compete in the competently run micro blogging market because mastodon instances are free and have no ads. Instead they competed with twitter in the incompetently run micro blogging market.
- mabbo 6y agoNah man, I won't criticize too hard. There but for the grace of god goes I, you know? I've had flakey dependencies. I've thought "maybe fail open is okay in this one case". You're growth hacking your company and you don't want to be held back because a dependency can't handle your scale. And hey, if a few fraudulent accounts get in, we'll just clean them up later. Cost benefit analysis here, right? But the road to hell is paved with trying to improve user experience.
- enkid 6y agoIsn't that exactly what the above comment is saying?
- user-the-name 6y agoSo, you agree with what I said.
- mabbo 6y agoYeah, but you said it with what looked like a lot of sarcasm and criticism. I said it with a tone of "Oh shit, I could have done exactly the same thing". Empathy. But it's a fun point of the nuances of language, isn't it? Maybe I misunderstood you.
- myWindoonn 6y agoWell, having empathy with growth hackers is reprehensible and worth critiquing. The idea of growing a business for the sake of having a big business is horrifying; it's the desire to explicitly build a large social institution and use it to damage and oppress people. From that perspective, you're the one lacking in empathy; you would like us to have our sympathies lie with the few who build businesses, rather than the many who are harmed by the business.
- amanaplanacanal 6y agoI think you are allowed to have empathy for both.
- narcissismo 6y agoAgreed that the problem looks like 'fail open', but there is the additional possibility that they had no plan for this failure mode at all beyond timing out. In that context, and with folks with no regard for consequences in charge, an emergency decision to allow everything seems plausible.
- jimmydorry 6y agoThat seems the most likely scenario. This was their make or break opportunity. They should have disabled password resets as soon as twillio deplatformed them.
- gwbas1c 6y agoThere's a surprising amount of insecure code in the wild; and naive engineers who are willingly ignorant in their security practices. I'd assume that Parler's engineers motivations had more to do with politics than providing a secure platform for protecting dissidents under duress. (Or, if we look at the history of a recent major war, the mediocre engineers working for the other side thought they were the good guys.)
- vsareto 6y ago>and naive engineers who are willingly ignorant in their security practices. Fairly sure we could replace algorithm and data structure whiteboard interviews with security interviews and we'd all be better off
- austincheney 6y agoI am certain most software engineers would abysmally fail the Security+ exam, which is the entry level for security practice. But a far more expedient process is to just give candidates an essay exam to see if they are functionally literate in their profession.
- whatiscomputer 6y agoCan you outline what you might expect in an essay exam for a software engineer position? Would it take the form of a standard interview question: "Write a few paragraphs on what happens when you press a key on the keyboard" Or would it use the medium to ask a question less appropriate in an oral interview process? Genuinely curious what you envision with this format.
- austincheney 6y agoThe goal is to assess a candidate’s ability to communicate technical matters quickly with structure, organization, and planning. Secondary considerations include the ability to follow simple instructions, command of written language, and accurate descriptions of technical subjects.
- chokeartist 6y ago> I would also probably buy said malicious actors a beer if I met them, accompanied by a high five. Take your lazy dicksucking elsewhere. Suggestion: Go back to reddit.
- raverbashing 6y agoThe old age question with fail-closed is then not locking yourself out when things go wrong Everything has/should have a "break window" escape, and yes, that's a security weakness, but I don't see many alternatives to that.
- jakelazaroff 6y agoThe platform operator should have such a mechanism, yes. Not randos on the Internet the moment a critical dependency fails.
- thinkharderdev 6y agoWhen you own the platform and source code, then you always have a "break window" escape of updating the code. You can also have it fail open only when requests are coming from the internal network, or have a fail-safe authentication mechanism that allows authentication with a super-admin password that can be used "in case of emergencies."
- iamEAP 6y agoMore speculation on my part: I wonder if rather than a fail-open decision, it’s just how they designed local dev to work and the failure of the provider caused the app to behave as if in local dev mode.
- Breza 6y agoThat's a really good theory.
- MrBuddyCasino 6y agoTo give a bit of context, this is the "Keyboard Cowboy Hack The Planet" Parler lead engineer: https://pbs.twimg.com/media/ErcFo5tXAAAa0KP?format=jpg&name=medium https://pbs.twimg.com/media/ErcFo5tXAAAa0KP?format=jpg&name=...
- deleted 6y ago[deleted]
- ganoushoreilly 6y ago> https://pbs.twimg.com/media/ErcFo5tXAAAa0KP?format=jpg&name= https://pbs.twimg.com/media/ErcFo5tXAAAa0KP?format=jpg&name=... I'm not following, what does this provide in support of the discussion? What context does this provide other than a picture and username? If the notion is of this person being lower or lesser because they worked for parler, then you aren't seeing the forest through the trees. Plenty of engineers make mistakes, many are just as ego centric. Go to Defcon, talk to all the expert "hackers" I guarantee 95% of the people there make common mistakes, we all do.
- MrBuddyCasino 6y ago> If the notion is of this person being lower or lesser because they worked for parler No. I support free speech. But I for one wouldn't trust someone with my security who approaches his jobs like a "cowboy hacker". Infosec is hard and needs to be taken seriously. Only the paranoid survive.
- ganoushoreilly 6y agoI agree in not using the language as this gentlemen did, but sadly more and more people use it. I also abhor "infosec rockstar" and "Rockstar Developer" etc.
- secondcoming 6y agoThat's uncalled for.
- nijave 6y agoI've seen similar setups to allow testing suites/local/lower environments to allow less restricted access. You have to be sufficiently careful how they work to prevent misconfiguring the real thing which may have happened here Example: In production, a load balancer or other proxy handles authentication and passes a signed JWT to the application but running locally the application will take a JWT directly and signature verification is disabled. In this case, the application has multiple checks in place to make sure it's running locally and in production environments it has network policies to only allow traffic from the authentication infrastructure.
- triangleman 6y ago>I would also probably buy said malicious actors a beer if I met them, accompanied by a high five. You would, would you? Thousands of individuals who by and large wanted to try out a competitor to Facebook ended up getting their personal details downloaded and leaked (and we're talking about very sensitive details here), and you're going to buy a beer for the criminals who did this? I assume before you turn them into the authorities for their 10-20 year sentences?
- afavour 6y ago> Thousands of individuals who by and large wanted to try out a competitor to Facebook That is a very, very generous take. And if that's all users were doing then their data being breached is regrettable but not world ending.
- drak0n1c 6y agoIt is an appropriate take. For years Parler was shared person to person as an alternative to Facebook, and even liberals who were upset at Facebook tried it out.
- triangleman 6y agoThat's a very, very callous take.
- im3w1l 6y agoI was told that if twitter wouldn't have me I should join Parler. But now I learn you are all cheering for Parler being hacked? I don't understand, should I use Parler or not?