7 ms·

If you don't use Two-Factor Authentication, and you have a public profile, the question isn't if your account will be compromised, but when. Apparently, for Mr

• jacquesm 4y ago
  There is no way that my account password was compromised without a much more elaborate hack of Twitter, either that or someone social engineered them to change my password.
  • ineptech 4y ago
    I think 2FA is to guard against someone gaming their "lost my password" process as much as against someone brute-forcing your pw.
    • jacquesm 4y ago
      Yes, but that would actually be less secure because my phone number is quite public and I'd be a SIM swap attack away from someone being able to compromise this account in a way that I would not be able to easily recover from (and to lose my long time phone number in the process).
      • latchkey 4y ago
        You don't have to use SMS for 2FA on twitter. Have you checked: https://twitter.com/settings/apps_and_sessions https://twitter.com/settings/apps_and_sessions
        • jacquesm 4y ago
          That brings up a page where Twitter wants my phone number, which they can't have.
          • latchkey 4y ago
            You're assuming at this point they want your number. It is not unreasonable to assume that this has been changed to the attackers number.
            • jacquesm 4y ago
              True, but they are still asking for it even now and they prefix it with the NL country code.
              • latchkey 4y ago
                Easy enough to figure out NL, your phone number is in your HN profile. Then, the hacker just gets a local number, which should be easy enough these days.
                • jacquesm 4y ago
                  True, but I would assume this is because Twitter has geolocated my IP to NL.
          • neogodless 4y ago
            Oddly enough I was able to select between [ Text message, Authentication app, Security key ]. I chose Authentication app, and I was not asked for my phone number. Though your account may now be in a "special state" due to these circumstances. EDIT: Ah I see elsewhere you said you don't use a smart phone (thus, no authentication app.)
      • jffry 4y ago
        AFAICT you can configure TOTP / Security Key based MFA for Twitter and disable text messages, but I don't recall if they force you to give them your phone number first: https://twitter.com/settings/account/login_verification https://twitter.com/settings/account/login_verification Regardless that still wouldn't protect you against somebody social engineering their support team. The account security page at https://twitter.com/settings/security https://twitter.com/settings/security has an "Additional password protection" but that seems to inhibit automated password reset requests, not support-related ones.
  • adgjlsfhk1 4y ago
    or you have a keylogger on your computer, or were phished yourself
    • jacquesm 4y ago
      Not a chance. Seriously, I'm if anything utterly paranoid about this sort of thing and this box is as secure as it ever was.
      • latchkey 4y ago
        Paranoid would imply that you set up Authenticator app based 2FA and a Security key. ;-) https://twitter.com/settings/account/login_verification https://twitter.com/settings/account/login_verification
        • jacquesm 4y ago
          I don't have a smart phone and don't want to give Twitter my phone number because I see that as a risk rather than a solution.
          • latchkey 4y ago
            Wow, TIL that you don't have a smart phone, so interesting! Anyway, twitter has had app based 2FA since the end of 2017... https://techcrunch.com/2017/12/20/twitter-adds-support-for-app-based-two-factor-authentication/ https://techcrunch.com/2017/12/20/twitter-adds-support-for-a... A year ago, they added security key support: https://9to5mac.com/2021/06/30/twitter-users-can-now-add-security-keys-as-the-only-two-factor-authentication-method/ https://9to5mac.com/2021/06/30/twitter-users-can-now-add-sec... You don't need a phone to have security.
            • jacquesm 4y ago
              I don't have a smartphone specifically because I believe they are insecure by design, at least one company and a whole raft of employees there have access to it and that's before we get into automatic updates of the software on those devices and so on. When I say I'm pretty sure that this machine wasn't compromised that is because I'm utterly paranoid when it comes to stuff like this. Possibly not paranoid enough - given the evidence just obtained...
  • garrettgarcia 4y ago
    Your account being compromised doesn't necessarily mean your password was compromised. Attackers are constantly developing new ways of accessing people's accounts. There's no valid reason to assume that there was an "elaborate hack of Twitter." Even people who are very careful, as it sounds like you are, can be successfully targeted. I don't know if turning on 2FA would have prevented this, but it sure wouldn't have hurt.
    • jacquesm 4y ago
      Then I'm super interested in the mechanism used because I was under the impression that as long as my password is secure my account is secure barring a hack of Twitter at an entirely different level. 2FA the way Twitter uses it (using SMS to phone number) would in my opinion be less secure rather than more secure because it opens up a whole slew of possible attacks that would then also involve my phone.
      • malepoon 4y ago
        Twitter also supports WebAuthn security keys as 2FA, much stronger than SMS/TOTP.
      • ericabiz 4y ago
        FYI, Twitter supports Google Authenticator as well.
        • jacquesm 4y ago
          That might be worth setting up, thank you.
  • oh_sigh 4y ago
    Or you just accidentally typed your password into the wrong site, perhaps via phishing? Believing you weren't/couldn't be phished is a great way to get phished again...
    • jacquesm 4y ago
      No, this is not possible. This password was generated by Firefox and apart from the test earlier to see whether or not it was changed I have never used it elsewhere much less copied it. It would have to be a session hijack or something like that.
  • mort96 4y ago
    I'm not saying this is what happened, but compromising your e-mail is also a possibility. Also, I'm not sure how you can say "there is _no way_" your account password was compromised. Can you know for certain that you haven't ever executed code which couldn't potentially be malicious or have security issues? Hell, if you use a web browser there's a non-zero chance that some website you visited was compromised to serve you some javascript which exploits a zero-day in whatever browser you use. You can say that's unlikely, but there's a lot of possible scenarios like that, and you're worryingly willing to just dismiss them all and say there's _no way_ this could be anything other than a vulnerability on Twitter's side.
    • jacquesm 4y ago
      That is true, my email could be compromised. But: my browser - which I use to access my email - is locked down to the point that a normal user probably wouldn't find it much fun, between umatrix and adblock plus there isn't a whole lot of javascript that runs before I authorize it. Agreed that it is possible. But still unlikely.