3 ms·

I guess I phrased that poorly. Yes, there was some discussion about how it could have been worse. However I wanted that discussion to be more than us shrugging

by slg 5y ago

I guess I phrased that poorly. Yes, there was some discussion about how it could have been worse. However I wanted that discussion to be more than us shrugging our shoulders and saying "we dodged a bullet". There was no real discussion either about standards in the tech industry or political discussions regarding legislative changes in order prevent that worse version from happening in the future. We didn't seem to learn anything from it.

staticassertion 5y ago
That's true of almost every breach though.
- slg 5y ago
  Should we stop calling out a bad thing just because it isn't the first bad thing of its kind to happen?
  - staticassertion 5y ago
    I guess if your statement is intended to be broad, sure. It seemed targeted to this breach, which yeah I think it's sort of wrong to call out one breach for being exactly like all other breaches.
azinman2 5y ago
What legislative changes could have prevented this or something worse in the future? Every security breach is different and often nuanced.
- slg 5y ago
  I wanted a discussion about it. I'm just a random developer who doesn't have the perfect answer. Yet some obvious things that might help would be to increase penalties for breaches and potentially require more stringent security auditing for companies of a certain size.
  - azinman2 5y ago
    I think the reality is security is really hard, and you only need 1 weakness for someone to drive a truck through. The biggest weakness time and time again is humans, and that's exactly what was attacked here with Twitter via social engineering. You can put all the penalties you want, but ultimately business needs and reality will make it so certain humans have powers that are high-up, which then creates unavoidable weaknesses. Just look at what happened with Ubiquiti and their head of cloud basically blackmailing the company in secret... they were attacked from within. How could that have been prevented assuming the person passes background checks and has years of relevant experience? Many sectors (finance, health care, etc) have all kinds of auditing requirements. I've helped answer some of these audits. It's largely just a bunch of checkboxes for obvious stuff, and in general, isn't how anyone would attack a company that's moderately competent. I've seen and fixed security vulnerabilities in startups that no one else recognized where there, despite passing all these 3rd party audits. I don't know what more could have been done without extremely knowledgeable people look at every aspect of your business in absolute depth that in part only comes from actually working/building it in the first place. Such experts are rare finds, yet the number of companies with computers attached is far greater. I'm not against legislation, and I think good legislation would look like taking companies such as Equifax out of business. We don't need total incompetence continuing to be central to society's function. But we also need to be realistic about what can be achieved.
    - slg 5y ago
      You can never eliminate the possibility of a security incident, but there are easy steps that can be made to reduce the risk. Clearly Twitter didn't do enough of them. For example, they had too many people with too wide permissions which increased their surface area for a social engineering attack. They didn't have an enhanced security policy for highly targeted users such as requiring approval from multiple people which would reduce the success rate of social engineering attacks. They also didn't have the proper monitoring of these high permissioned accounts to quickly identify the source of the breach and therefore they couldn't easily stop it after it begun. These might just sound like "checkboxes for obvious stuff", but they would have helped if Twitter checked those boxes.
basisword 5y ago
How is this a tech issue? The issue is powerful politicians using private social media companies as a means of communicating with the public. Politicians and other can instantly prevent the risk by only communicating through official means.
- slg 5y ago
  Government communication has no value if it doesn't reach it audience. They need to be where the people are. This also isn't a problem limited to governments and politicians. It calls into question the authenticity of every account on Twitter and that includes other important accounts which can cause damage if compromised such as journalists and news organizations.
  - BeFlatXIII 5y ago
    Good. Trust nothing you see. It's all kayfabe.
  - riffic 5y ago
    > They need to be where the people are And as a corollary, the people will go to whatever channels exist. This has been something done many times as mediums change. Newspapers to Radio. Newsreels to Television. Then to the internet, we started with everyone telling you their AOL keyword. Then the web, and then social media. If authenticity is the concern, these players (journalists/politicians) should adopt W3C recommendations and stand up social media services from their own web presence.
  - mulmen 5y ago
    Everything on Twitter should be questioned. It's a private company. They only have their reputation. It is not and should not be suitable for important communication. Imagine if all official communication came through CNN, or the NYT. It's completely nonsensical. Anyone with access to Twitter has access to whitehouse.gov. Twitter isn't delivering value here, they are a huge societal risk.

by slg 5y ago

staticassertion 5y ago

That's true of almost every breach though.

slg 5y ago
Should we stop calling out a bad thing just because it isn't the first bad thing of its kind to happen?
- staticassertion 5y ago
  I guess if your statement is intended to be broad, sure. It seemed targeted to this breach, which yeah I think it's sort of wrong to call out one breach for being exactly like all other breaches.

azinman2 5y ago

What legislative changes could have prevented this or something worse in the future? Every security breach is different and often nuanced.

slg 5y ago
I wanted a discussion about it. I'm just a random developer who doesn't have the perfect answer. Yet some obvious things that might help would be to increase penalties for breaches and potentially require more stringent security auditing for companies of a certain size.
- azinman2 5y ago
  I think the reality is security is really hard, and you only need 1 weakness for someone to drive a truck through. The biggest weakness time and time again is humans, and that's exactly what was attacked here with Twitter via social engineering. You can put all the penalties you want, but ultimately business needs and reality will make it so certain humans have powers that are high-up, which then creates unavoidable weaknesses. Just look at what happened with Ubiquiti and their head of cloud basically blackmailing the company in secret... they were attacked from within. How could that have been prevented assuming the person passes background checks and has years of relevant experience? Many sectors (finance, health care, etc) have all kinds of auditing requirements. I've helped answer some of these audits. It's largely just a bunch of checkboxes for obvious stuff, and in general, isn't how anyone would attack a company that's moderately competent. I've seen and fixed security vulnerabilities in startups that no one else recognized where there, despite passing all these 3rd party audits. I don't know what more could have been done without extremely knowledgeable people look at every aspect of your business in absolute depth that in part only comes from actually working/building it in the first place. Such experts are rare finds, yet the number of companies with computers attached is far greater. I'm not against legislation, and I think good legislation would look like taking companies such as Equifax out of business. We don't need total incompetence continuing to be central to society's function. But we also need to be realistic about what can be achieved.
  - slg 5y ago
    You can never eliminate the possibility of a security incident, but there are easy steps that can be made to reduce the risk. Clearly Twitter didn't do enough of them. For example, they had too many people with too wide permissions which increased their surface area for a social engineering attack. They didn't have an enhanced security policy for highly targeted users such as requiring approval from multiple people which would reduce the success rate of social engineering attacks. They also didn't have the proper monitoring of these high permissioned accounts to quickly identify the source of the breach and therefore they couldn't easily stop it after it begun. These might just sound like "checkboxes for obvious stuff", but they would have helped if Twitter checked those boxes.

basisword 5y ago

How is this a tech issue? The issue is powerful politicians using private social media companies as a means of communicating with the public. Politicians and other can instantly prevent the risk by only communicating through official means.

slg 5y ago
Government communication has no value if it doesn't reach it audience. They need to be where the people are. This also isn't a problem limited to governments and politicians. It calls into question the authenticity of every account on Twitter and that includes other important accounts which can cause damage if compromised such as journalists and news organizations.
- BeFlatXIII 5y ago
  Good. Trust nothing you see. It's all kayfabe.
- riffic 5y ago
  > They need to be where the people are And as a corollary, the people will go to whatever channels exist. This has been something done many times as mediums change. Newspapers to Radio. Newsreels to Television. Then to the internet, we started with everyone telling you their AOL keyword. Then the web, and then social media. If authenticity is the concern, these players (journalists/politicians) should adopt W3C recommendations and stand up social media services from their own web presence.
- mulmen 5y ago
  Everything on Twitter should be questioned. It's a private company. They only have their reputation. It is not and should not be suitable for important communication. Imagine if all official communication came through CNN, or the NYT. It's completely nonsensical. Anyone with access to Twitter has access to whitehouse.gov. Twitter isn't delivering value here, they are a huge societal risk.