3 ms·
The hack of Parler after Twilio and Okta cut them off is way more interesting. Surprised that I haven't seen a thread on HN frontpage about that. tl;dr failure
by vmception 6y ago
The hack of Parler after Twilio and Okta cut them off is way more interesting. Surprised that I haven't seen a thread on HN frontpage about that.
tl;dr failure of their user authentication system allowed anyone to make an account, including an admin account. they then privilege escalated and imaged the entire service and made a docker container that anyone can use. So whoever did the first thing maybe has liability under CFAA and other means, but everyone else doesn't and they are leaking everything.
User uploaded pictures still have metadata attached, including GPS coordinates. It is hilarious and also alarming.
- gerikson 6y agoThis spent 5 hours on the frontpage: https://news.ycombinator.com/item?id=25729088 https://news.ycombinator.com/item?id=25729088
- vmception 6y agothanks, I was looking for that kind of thread
- nodamage 6y agoIt was actually posted multiple times last night but got flagged because the only source was an unverified reddit post that was later debunked by the researcher that actually downloaded the data. All of the data that was downloaded was via publicly accessible links, no admin privileges were necessary.