25 ms·

An incident impacting 5M accounts and private information on Twitter

• bink 4y ago
  > When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. > In July 2022, we learned through a press report that someone had potentially leveraged this and was offering to sell the information they had compiled. After reviewing a sample of the available data for sale, we confirmed that a bad actor had taken advantage of the issue before it was addressed. Yikes. Sounds like they either didn't dig deep enough to see if it was exploited or they don't keep records long enough to be sure.
  • londons_explore 4y ago
    Probably the latter - all companies operating in the EU have had short (ie. 30 days) retention policies on anything user-identifiable (ie. http logs) for a while now. But if they didn't keep sufficient logs, they should have alerted the users back then, not now.
    • bink 4y ago
      AFAIK there is an exception for security purposes. They could be hashing or "anonymizing" the IPs and keep the data longer.
      • tick_tock_tick 4y ago
        No that's not valid at all! You must remove any trace of your ability to backwards engineering the IPs. Hashing isn't sufficient since it's so easy to run over the whole IPv4 space. This is one of the trade offs.
        • zaarn 4y ago
          You can if the hash collides within the IPv4 address space; ie it's a hash of less than about 16 bits. Enough to let your roughly see if something fishy is going on but you can't reverse engineer to any specific IP, only a set of 64 thousand.
          • tick_tock_tick 4y ago
            That isn't good enough. By taking that hash and old request data combined with your current request logs it's enough to de-anonymization a significant portion of those logs making you not in compliance.
            • zaarn 4y ago
              Data from the past few days we do have a legitimate interest in; protecting our network. If someone is spamming us we need to be able to find out who did it and the only way to do that is deanonymized logs to begin with. Atleast in my workplace we have worked with the DPA to ensure that we are in compliance and there is no issue in keeping around 7 days of IP logs without further anonymization. All or long term logs are hashed below the bit minimum, and that can't be paired with old request data as easily since we strip all but major version identifiers from User Agents, for example.
        • heurisko 4y ago
          Wouldn't salting mitigate this?
          • 0x457 4y ago
            If something uniquely identifies someone, it's considered a PII and a salted (but still useful) hash of the IP address is that. At least under GDPR. That means you will need to throw away the salt and have different salt for every instance. At that point, you might as well replace with a random string, and that isn't very useful. "In the context of the European GDPR the Article 29 Working Party has stated that while the technique of salting and then hashing data “reduce[s] the likelihood of deriving the input value,” because “calculating the original attribute value hidden behind the result of a salted hash function may still be feasible within reasonable means,” the salted-hashed output should be considered pseudonymized data that remains subject to the GDPR." Under CCPA, I think that is enough, HOWEVER, business must implement business processes that specifically prohibit reidentification. So again, not useful at all in this case. The question should be is IP address a PII or not. Under CCPA and GDPR it is, but only if it “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
      • deleted 4y ago
        [deleted]
      • AtNightWeCode 4y ago
        For security reasons IP addresses needs to be available in plain text. There is no time limit for how long time you can store the data, but you need to be able to motivate why.
    • grogenaut 4y ago
      AFAIK there are exceptions for many purposes, taxes, law enforcement, "critical business functions", etc of the 30 day window. Tax records, which can be quite PII and personal, need to be kept for ~7 years in the US for instance. Anything that needs to go to law enforcement stays around until the court case is over which can be longer.
  • addingnumbers 4y ago
    "We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.
    • hunter2_ 4y ago
      I always wonder who "we" refers to in that usage, legally speaking. Does it refer only to a subset of employees / board members who are authorized to speak for the company? Because then even if someone analyzing logs sees something damning, if middle management is trained to stop that knowledge from reaching the top, then those speaking for the company can continue saying "we" didn't know it.
      • lrvick 4y ago
        I have 100% seen this happen.
        • johndhi 4y ago
          really? what do you mean 'middle management is trained to keep that from getting to the top'? intentional malfeasance? where I work people are trying their best but dealing with complex systems, memories, and methods of communication. because of this, security issues are sometimes missed, sometimes poorly communicated, and sometimes poorly remediated.
          • hobs 4y ago
            Almost all companies operate with an extremely low level of trust and most places are blame, shame, and ultimately game the system all the way down. Hiding something often takes years to uncover and by then management has moved on, maybe even to their second company!
          • t-3 4y ago
            Probably not 'trained' as much as 'heavily incentivized'. Nobody wants to be the messenger that gets shot for bringing bad news. Much easier to cover up and tell the big boss what they want to hear as long as you can.
  • nolok 4y ago
    You seem to believe "we had no evidence to suggest someone had taken advantage of the vulnerability" implies "we looked for any evidence of it", it doesn't, not in that case nor in any similar situation.
  • grogenaut 4y ago
    Or they don't monitor that system for that type of access at all and so literally don't know.
  • AvImd 4y ago
    https://astralcodexten.substack.com/p/the-phrase-no-evidence-is-a-red-flag https://astralcodexten.substack.com/p/the-phrase-no-evidence...
    • brian_cloutier 4y ago
      This link is not particularly relevant, as it talks about how the phrase "no evidence" is used within a specific community and that community has little overlap with the community which writes press releases after security incidents. Security incident response teams do not have the same strange distinction between "real" evidence and the non-published non-peer-reviewed evidence which cannot be relied on or even really mentioned.
  • hertzrat 4y ago
    Out of curiosity, why is it only 5M and not 500M? You would think the same vulnerability applied to every server, not just one or one cluster, if they are using automated deployments
    • uncletammy 4y ago
      Could be a time intensive exploit. Maybe they didn't have enough time to mine the other 455M.
    • alex_young 4y ago
      The rest are bot accounts right?
    • LegitShady 4y ago
      Doing it slowly over time to not raise an alarm and collect the information, rather than twitter noticing a massive upticks in password resets that don’t go through?
• londons_explore 4y ago
  So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great. But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it. It was only when the press started to notice they finally disclosed the leak. That isn't just one bug causing a security leak - it's a chain of bad decisions and bad security culture, and if anything should attract government fines for lax data security, this is it.
  • myself248 4y ago
    The whole announcement reeks of "Stop hitting yourself!" What scum. They had lots of chances to fix this, the first one being not collecting phone numbers in the first place. They chose to do that, and then they didn't adequately protect it, and now they're oh so very surprised that someone might be doxing their most vulnerable users. If anyone is harmed by this, Twitter should be held liable.
    • hackernewds 4y ago
      didn't actually not just protect the phone numbers. They actively used it illegally to market services outside of the purpose for which the numbers were gathered https://www.theverge.com/2022/5/25/23141968/ftc-doj-twitter-settlement-phone-number-security-ad-targeting https://www.theverge.com/2022/5/25/23141968/ftc-doj-twitter-...
    • EGreg 4y ago
      It's not just Twitter. It happens every few months. The problem is centralized sites having "real name policies", requiring you to put your phone number and other crap: https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says-only-industry-where-this-regularly-happens/ https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says...
  • eli 4y ago
    Requiring a phone number is part of fraud & spam prevention. Maybe you'd make a different tradeoff but that's not "no reason."
• londons_explore 4y ago
  I think you will see more of this class of attack. Lots of companies have various 'forgot my username'/'forgot my password'/'trying to sign up for a new account with a new email address but existing phone number'/'add a friend by email or phone' flows. It's very easy to accidentally leak some info that shouldn't be leaked while implementing such a flow, since you are peering into the users database querying by email/phone/other identifier while the user hasn't properly authenticated yet.
  • jdmichal 4y ago
    Yes. The proper way to implement this flow is to ask for the information, and then present the exact same result screen regardless of the actions taken. Any additional information or action should be done exclusively through the contact information you have on record.
    • pyrolistical 4y ago
      And making sure constant time on the response. Otherwise the slower response likely corresponds to a real phone number if the backend synchronously did more actions, such as sending a recovery email. The backend would need to be really slow however in order for a strong enough signal for this to be useful.
      • klysm 4y ago
        Still it’s so much better to have the binary information of whether or not an account exists with that information than exactly which account it is.
        • nishs 4y ago
          No, the binary information too is a privacy concern. For example, one could enter a coworker's phone number to confirm that the coworker has a 4chan account. This isn't good.
  • deleted 4y ago
    [deleted]
• some_random 4y ago
  >If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
  • kordlessagain 4y ago
    The company entity requires blaming others. It can't blame itself, otherwise stakeholder value is affected. If you want to blame anyone, blame the environment that allows these types of actions by companies, or simply stop using them. BTW, no Twitter account is "ours". If it was, we could download everything (friends and all) and move it somewhere else. Twitter needs to take ownership of all data on their platform - user accounts included. Trying to separate them into different entities is ridiculous.
    • 6stringmerc 4y ago
      These are cogent points and I completely agree not admitting fault seems the playbook for publicly traded companies. It’s unfolding in real-time with Tyler Technologies and we’ll have to see how it plays out. Intelligent institutional investors are poring money into a company that is responsible for leaking millions of intended to be confidential CRIMINAL RECORDS and is trying to blame JudyRecords for finding their mistake. Again it goes to show we don’t really own anything that turns digital, and no safeguards are guaranteed. The only recourse is legal action, which is, IMHO going to bankrupt Tyler r force numerous spin offs to pay the class action results from the CA State Bar…and potentially hundreds more.[0] The environment is one of no consequences when hiding behind a corporate banner, for most intents and purposes. Choose who you work for wisely. [0] www.JudyRecords.com
    • vladtheimpala 4y ago
      > It can't blame itself, otherwise stakeholder value is affected. One would think dishonestly blaming others for the consequences of their own conduct would also affect stakeholder value.
• londons_explore 4y ago
  Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
  • WaitWaitWha 4y ago
    In the USA. They range from 4 (St. Helena) to 13 (Austria), I believe.
    • RL_Quine 4y ago
      It's typically smaller though, not every phone number is allocated and many are in sequential groups. Some are special cased, you don't need to search any number matching `****555***` in north america for example, which cuts down on the search space quite a bit.
      • mrb 4y ago
        "Quite a bit"? Filtering out ***555**** removes only 0.1% of phone numbers ;)
        • RL_Quine 4y ago
          That's one example of an invalid range, not all of them. Lots of the area codes in north america just haven't been used for one reason or another.
        • tomjakubowski 4y ago
          I didn't do the math here but: Filtering out 5*... would remove 10% of the search space. (dots mean "followed by more stars") Filtering out *5*... would remove 1%. So wouldn't ***555**** remove closer to 0.01%, not 0.1%?
          • 4y ago
• mromanuk 4y ago
  Is there a way to know if your own account is compromised?
  • bluetidepro 4y ago
    > We will be directly notifying the account owners we can confirm were affected by this issue. We are publishing this update because we aren’t able to confirm every account that was potentially impacted, and are particularly mindful of people with pseudonymous accounts who can be targeted by state or other actors. So they may contact you, or may not. It would be nice if this gets added to something like haveibeenpwned
• cecilpl2 4y ago
  > In January 2022, we received a report through our bug bounty program > This bug resulted from an update to our code in June 2021 Does this mean the problem existed for 7 months and nobody at Twitter noticed until they received a bug report?
  • ameliaquining 4y ago
    That's not unusual for a security bug; it's not like this stopped people from using the app in a way that they'd loudly complain about or that would show up in metrics.
  • mcintyre1994 4y ago
    Given they didn't think it was exploited they must have pretty poor logging and analytics around that part of their infrastructure. Someone managed to abuse it millions of times and they didn't know about it even after they'd fixed it and knew exactly where to look for abuse.
    • Beaver117 4y ago
      Curious what kind of logs/analytics would you add and watch to catch something like this?
      • tpxl 4y ago
        You should notice a spike in any request logging metric if someone exploits this.
        • deleted 4y ago
          [deleted]
        • robryan 4y ago
          Depends on the normal usage, if someone was doing this across unique ips and slow enough that the usage change may be say 1% it wouldn't be noticed. A more sophisticated system that could look at the ips in use and compare to previously used ips for the accounts would notice something.
• jlarocco 4y ago
  I'd love if they brought back the "fail whale" for this kind of announcement.
• smm11 4y ago
  I already fixed it, by not using Twitter.
  • cowtools 4y ago
    Truly. It is infuriating dealing with the phone number rigamarole. Why does X company require me to use a certain phone number/IPv4 address/2FA? It doesn't improve security, it does not protect against sybil attacks. The reason is vendor lock-in and data collection. It's not worth dealing with this crap to access another time-wasting/brainwashing app. At the same time, there is no shortage of users here willing to give lip service to these backwards practices.
• NelsonMinar 4y ago
  Isn't this the second or third time for Twitter to have this exact same flaw? From 2020: https://www.socialmediatoday.com/news/twitter-uncovers-security-flaw-in-phone-number-to-account-matching-process/571692/ https://www.socialmediatoday.com/news/twitter-uncovers-secur... I might be confused; this is a very old feature of Twitter that does have an opt out. Maybe this new disclosure is the opt out didn't work? https://help.twitter.com/en/safety-and-security/email-and-phone-discoverability-settings https://help.twitter.com/en/safety-and-security/email-and-ph... It's a different problem, but this year Twitter also got a $150M fine for illegally using the phone numbers they demand from users for marketing purposes. https://www.theverge.com/2022/5/25/23141968/ftc-doj-twitter-settlement-phone-number-security-ad-targeting https://www.theverge.com/2022/5/25/23141968/ftc-doj-twitter-...
  • hackernewds 4y ago
    We consistently have to go through Data protection practices, and limit the purpose of what the data collected can be used for. This seems like either a blatant miss in process, or willful ignore where $150m is under the EXPECTED value of the rewards through marketing
• Kukumber 4y ago
  Whoever wants to get rid of anonymity on the internet will have to solve problems like this first Until then :middle_finger:
• slater 4y ago
  is this the same security issue that was used to unmask who was behind that "libs of tiktok" account?
  • yieldgap 4y ago
    no, I think the 'libs of tiktok' person included their personal info when registering a domain
• seydor 4y ago
  Thankfully most of those accounts were bots
• throw03172019 4y ago
  >If you operate a pseudonymous Twitter account…we recommend not adding a publicly known phone number to your Twitter account. Dear Twitter, We need a phone number to be able to use Twitter longer than a week otherwise we get blocked for “suspicious activity” (which is entirely bullshit - logging in from the same IP is not suspicious). So what should we do? Go to AT&T and open a new line? Jokers.
  • lysergia 4y ago
  • deleted 4y ago
    [deleted]
• HL33tibCe7 4y ago
  Can we have a proper postmortem about this please, with information about the exact process that was required to obtain this information? > We take our responsibility to protect your privacy very seriously and it is unfortunate that this happened. Patently not seriously enough.
  • ryandrake 4y ago
    It's always hilarious: Whenever any company is caught not taking X seriously, the first thing they do is issue a press release that starts with "Here at COMPANY, we take X very seriously!"
    • mwigdahl 4y ago
      A story an old coworker of mine often told was about the CEO at a previous company he had worked for. This guy was apparently pretty scummy in general, but one time he got threatened with a lawsuit for sexually propositioning his secretary. He settled that issue with an under-the-table payout, but the first thing he did after that was to send out a stern memo to all staff warning them that "we will tolerate ABSOLUTELY NO sexual harassment at this company!"
    • tromp 4y ago
      Reminds me of how certain spam emails will proudly proclaim: This is not spam!
    • gtowey 4y ago
      You can pretty much read a list of company values to find out exactly the things they do only for show. The companies I've worked for have always ignored any stated values as soon as it costs them money or gets in the way of making money. Which is, you know, always.
  • hnburnsy 4y ago
    here is the bug report... https://hackerone.com/reports/1439026 https://hackerone.com/reports/1439026
• nlitened 4y ago
  I wonder how it affects the Musk’s case of declining to buy Twitter? Surely they concealed from him the fact of this breach?
  • tns-hn 4y ago
    Yes I wonder about this as well. Say Musk had good reasons to suspect some private information was at risk and Twitter kept denying anything was going on. No matter how minor the actual impact would be in the end, this would not paint Twitter in a favourable light especially in a legal battle where Musk claims Twitter held back vital information.
• moretestaccoun 4y ago
  Another reminder not to use Twitter. It's not worth it. Mastodon is better.
  • keepquestioning 4y ago
    Could not have picked a worse name for a social network.
    • commoner 4y ago
      Are you talking about Twitter or Mastodon? Many company and product names are awkward before they become mainstream.
      • keepquestioning 4y ago
        Twitter is light hearted. Mastodon sounds like obscure metal band
    • riffic 4y ago
      who cares, this is the ultimate in bike shedding. there's never a discussion on HN where someone brings up a product without this asinine comment about its name. btw Mastodon is great software and it has a great name and branding. It's all subjective.
• jmount 4y ago
  This evidence Twitter has 5.4mm actual accounts?
  • aeyes 4y ago
    Could be that they have 5.4M accounts with a phone number.
• rvz 4y ago
  I said this before years ago about Signal, Robinhood and Coinbase [0] and right now it's 2022 and SMS 2FA is still being used despite SS7 attacks, SIM swapping, one-click zero-day SMS attacks as found in Pegasus and sophisticated SMS phishing attacks. [1] Really. One needs to think about logging into any service that requires ONLY Phone number 2FA and this should be a wake up call. Twitter really should get a massive multi-million dollar fine for this breach. [0] https://news.ycombinator.com/item?id=29264937 https://news.ycombinator.com/item?id=29264937 [1] https://news.ycombinator.com/item?id=32385362 https://news.ycombinator.com/item?id=32385362
• sleepyhead 4y ago
  > January 2022, we received a report And they did not give notice to users. GDPR breach.
  • deleted 4y ago
    [deleted]
• taesu 4y ago
  5.4mm == some
  • kurupt213 4y ago
    All the non-bot active user accounts
• AtNightWeCode 4y ago
  Sounds like something that should have been found during pen testing.
• hnburnsy 4y ago
  I believe this is the vulnerability reported to Twitter which awarded $5000 from its bug bounty program. https://hackerone.com/reports/1439026 https://hackerone.com/reports/1439026
  • Nexxxeh 4y ago
    $5k seems embarrassingly low so something with such horrendous impact. Potentially allowing for doxing, and because phone numbers are the lynchpin for many 2FA and consumer-facing telco security is generally lax, total user hijacking across multiple platforms. What an absolute disaster.
    • languageserver 4y ago
      if the disclosure and fix time is half a year, a blackhat is now able to both claim the bug bounty and sell the day zero exploit
    • lrvick 4y ago
      I have found many far more serious bugs, even at larger companies, that have paid me under $500. No one feels security researchers time is even worth that of the internal engineers creating the bugs.
      • kfichter 4y ago
        Crypto bounties pay quite well; https://immunefi.com/ https://immunefi.com/
    • neilv 4y ago
      Besides impact, $5K also doesn't make sense when compared to employee compensation.
  • oars 4y ago
    Thanks for sharing this link. Twitter should've shared it in their post...
  • thenoblesunfish 4y ago
• pmlnr 4y ago
  What unit is mm? Millimetres?
  • eternalban 4y ago
    MM is 1 million. mm = 1 millimeter.
  • ewhanley 4y ago
    million (m = 1000, m * m = 1000000)
    • infradig 4y ago
      Since when? K/k = 1000, M/m = 1000000.
      • Thrymr 4y ago
        Also not consistently, SI units and prefixes are case sensitive.
  • deleted 4y ago
    [deleted]
  • Thrymr 4y ago
    This abbreviation is not in the article (nor is the number). And the HN headline now says "5M" which is maybe a more common abbreviation for "million".
• HL33tibCe7 4y ago
  So what you’re saying is that you discovered a vulnerability that leaked the private information of your users, said absolutely nothing for 6 months, then finally came clean, but only because you were forced to because people were selling data on the deep web. Please take your “sorry” and shove it where the sun doesn’t shine. You don’t “take our privacy seriously”. This is utterly ridiculous and unacceptable, and in a fair world you would be punished heavily for it. Edit: an earlier version of this comment criticised Twitter for not doing an investigation earlier to uncover the fact that a leak occurred. This accusation was based on me misreading the press report - see one of the child comments for details. I’ve removed that part of the comment.
  • gameshot911 4y ago
    >didn’t bother to do an investigation into whether it leaked data (which clearly is possible, because you’ve done it now) It sounds like they confirmed the exploit by looking at the hacked data, not by a renewed search of previously available logs.
    • HL33tibCe7 4y ago
      Yeah, I misread that part. Edited my comment.
  • winternett 4y ago
    The methods to scrape numbers from social media have been published on YouTube for ages now. They share those numbers publicly because they themselves run services that share user data with other companies openly... Twitter (for example) is used as an authentication service with Disqus and a few other online apps too, an online comment service which could easily save/track sensitive ID data across comments on multiple sites unwittingly to the user, so it's a really shady overreach if that is indeed the case. These numbers are gathered under the guise of security, but they are used for entirely different purposes. I think the real fault is in them forcing users to enter this type of data to begin with, because that makes the only options to surrender your data to them or to not use the app at all. It would be interesting to see if numbers from verified accounts were included in the leak, that would be very telling.
• cheshire137 4y ago
  The page isn’t loading for me and I notice Twitter itself is either slow or not loading at all right now. I also see a spike in reported problems for Twitter on DownDetector.
  • deleted 4y ago
    [deleted]
  • vidarh 4y ago
    It loads for me in the browser, but the app is failing to load data. EDIT: A few refreshes shows it's slow and occasionally failing in the browser for me...
    • busymom0 4y ago
      Twitter was actually down for few minutes. It just got fixed.
  • zrobotics 4y ago
    Archive link in case anyone is still having issues: https://archive.ph/HujUg https://archive.ph/HujUg
• danjoredd 4y ago
  And why does anyone still use twitter? Its a cesspit and they ALWAYS have some kind of security issue going on. Nothing of this magnitude, but still.
• kristjank 4y ago
  Good.
• matsemann 4y ago
  > How to Protect Your Account > (...) To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. Well, you're the ones constantly temporarily banning my account for not providing a phone number...
  • lysergia 4y ago
    Strange you say that. I’m six months into my pseudonymous account and they haven’t tried to extort my phone number. It’s like they know from my behavior that I don’t want to be doxxed by Twitter Inc. I signed up using a VPN and a weird email address, and used an AD blocker.
    • busymom0 4y ago
      Do they shadowban such accounts? Are you aware if your posts and comments are visible to others?
      • lysergia 4y ago
        I checked. I have a few alt accounts and all my tweets and interactions are visible when I visit my profile.
        • busymom0 4y ago
          And this is even when you visit the post (from someone else) which you reply to while being signed out of your account and your IP address? Most shadow banning show the posts if visited via the profile but are invisible if viewed as replies to someone else's post or while signed out and using different IP address. Might be worth checking. Not asserting that this is the case with Twitter though.
      • winternett 4y ago
        There are many different levels of shadowban apparently. You can be excluded from being able to trend, or gain followers, or to have post visibility at all based on what I've observed. It mainly gets triggered by complaining about Twitter or a favored sponsor... Twitter considers those things censorable, but not upsetting violence and shocking pr0n for some strange reason... ugh.
• whywhywhywhy 4y ago
  Pretty disgusting they don't have a thing to check if they leaked my personal information, which lets not forget they screamed and stamped their feet to force me to hand over in the first place. I never wanted to give you my phone number, Twitter. You demanded it.
  • mellosouls 4y ago
    Pretty disgusting they don't have a thing to check if they leaked my personal information From the linked notice, fwiw: "We will be directly notifying the account owners we can confirm were affected by this issue."
• RonMarken 4y ago
  Perhaps Twitter needs to make it easier to create accounts anonymously and stop virtue signaling (i.e suspend accounts created over Tor onion-service) With pseudonymous usage of public services information minimisation to maintain operational-security against private user-data being disclosed by external hackers or rogue insiders is a mantra that needs to be followed religiously.
  • lysergia 4y ago
    I’m six months in and they haven’t asked for a phone number yet. I dread the day when they do. This is where proficiency in the Twilio API comes in handy.
    • throwaway292939 4y ago
      Don't you still have to use an actual phone number when you sign up for Twilio?
      • demopathos 4y ago
        If you trust twilio security policy you can defer the weakness of Twitter policy in favor of the strength of twilio.
    • upupandup 4y ago
      when I started liking "too many" tweets I got hit with it and my mobile carrier (canada btw) refused to deliver txt msgs from Twitter so I could never get verified.
    • RonMarken 4y ago
      Created and accessed over Tor or a clearnet connection?
    • quickthrower2 4y ago
      Lucky you. I can't create another twitter account as my number is on a network unreachable by their SMS system. Worst of both worlds for me as when that number was on another network they could verify. So leaked number that I cannot even use to verify a second business account :-(.
• skrtskrt 4y ago
  Is this going to be the thing that gets Elon Musk off the hook for his billion dollar fine for backing out of the deal? They had a breach and actively actively hid it for an extended period of time. Obviously both sides have good lawyers, but it's hard to see how this doesn't hurt Twitter in regards to the legal battle over the Musk deal unwinding
  • collegeburner 4y ago
    This starts getting toward "everything everywhere is securities fraud". This probably would have come up in tech diligence but he waived that.
• hnburnsy 4y ago
  Since apparently Twitter doesn't have the logs, they should be purchasing the hacked dataset and notifying affected accounts.
• seydor 4y ago
  "We recommend not doing what we forced you to do"
• deadonarrival 4y ago
  See also: https://news.ycombinator.com/item?id=32367719 https://news.ycombinator.com/item?id=32367719
  • pvg 4y ago
    These make sense if there's discussion there otherwise they are just links to nowhere.
  • deleted 4y ago
    [deleted]
• Rackedup 4y ago
  It's one of the many reasons why I don't like to associate my phone number with an account for 2FA and such... Or any other information that they don't need (like name, etc...). I think that Google recently forced most accounts to give a phone number even if you don't use 2FA (probably for ID purposes). That's one reason why I like this service: https://www.emailnator.com/ https://www.emailnator.com/, instead of using my own gmail address for signups. Anonimity is going down the toilet really fast in the US...
• maerF0x0 4y ago
  This is why Managers and PMs should not be deciding priority of security betterments. I've never worked at, or heard of, a company that adequately incentivizes or takes posthoc corrective actions for EMs/PMs around long term consequences or brand threats. They're tragedies of the commons of sorts.
• LeoPanthera 4y ago
  "we recommend not adding a publicly known phone number or email address to your Twitter account." This is literally impossible. You can't create a Twitter account without a phone number. It sometimes allows you to do so, but then is blocked within 24 hours until you add one. It's insulting that Twitter should lie about that.
  • alx__ 4y ago
    > publicly known Note the PR words they used. Which amounts to, "If you want privacy, it's not our problem. Go create a virtual number somewhere."
    • codereviewed 4y ago
      IME, numbers they have classified has VOIP or otherwise not a consumer or business cell service are disallowed. Skype numbers do not work, and I have had a spotty experience with Google Voice numbers as well.
• politelemon 4y ago
  How did you arrive at the 5M figure, I didn't see the number of affected people in their post?
  • nishs 4y ago
    Same, I don't see the number in the article. Was it removed from the official Twitter post? An older external article[1] about the hack mentions 5.4M accounts. [1]: https://www.cshub.com/attacks/news/54-million-twitter-accounts-reportedly-on-sale-in-hacking-forum https://www.cshub.com/attacks/news/54-million-twitter-accoun...
• m1117 4y ago
  Yay, twitter is getting better!
• darkhorn 4y ago
  Turkish law authorities have abused Twitter's login system in the past several years. If an anonym Twitter account was critisizing Erdoğan they were trying to log in, try to reset the password, choose phone number and then Twitter was showing last two digits of the phone number. They also have list of known people who were critisizing the Erdoğan publicaly but without any bad words, unable to open a criminal case agains that person. Then they were matching probable phone numbers (last two digits) from Twitter with these knnown people'phone numbers. If there was a match (last two digits) they opened a criminal case. And then that person was being visited by police officers in the morning, arrested for several hours, then he had to attend hearings for 3 years, like once evry 4 months. Also he had to hire a lawyer, for 5 minimal salaries. At the end he probably wins the case if he is not the owner of that Twitter account, and Erdoğan pays around 1x minimal salary to defendant's lawyer.
• micrum 4y ago
  'some' accounts...
• notpushkin 4y ago
  Interesting how just throwing the 5M figure in the title changed everything for this post: https://u.ale.sh/some-accounts.png https://u.ale.sh/some-accounts.png
  • wmeredith 4y ago
    Well yeah. Some accounts could be two. If I see language like that in a headline, I pretty much ignore it. It's like when I see the word "may" in a headline. "New wonder drug may cure cancer." That isn't even news.
• NaturalPhallacy 4y ago
  >To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. And yet they actually demanded I give them mine, and have repeatedly, recently demanded a confirmation. Phone numbers are one of the worst 2fas.
  • phreack 4y ago
    Amen. Google is asking me to add 2FA to an account for work, and there's no way to do so except from phone numbers or Google Authenticator which I'd rather not use. It's the only service that doesn't let me use something like Authy for OTP.
    • t-sauer 4y ago
      I have the 2FA for my work account in 1Password (if that's reasonable is another discussion) so there should be a way to use something else besides Google Authenticator or phone number.
    • kernelcurry 4y ago
      That is not entirely true. If I remember correctly, if you select the Google Authenticator as your option, it will display a QR code. You can then scan the QR code and the OTP information will be in that payload that can then be pasted into you app of choose. (How o got mine I to 1Password)
    • londons_explore 4y ago
      You know Google Authenticator is just an implementation of the TOTP open standard right? There are plenty of alternative apps that will give you the same number to key in...
      • wlesieutre 4y ago
        Authy included
      • OJFord 4y ago
• nishs 4y ago
  I'm disappointed and growing hopeless about the state of software engineering at these companies that this sort of issue is not caught in engineering design documents, during development/debugging, or during code reviews. Any competent engineer should have the sensibility to have seen that the implementation they've designed or programmed leaks private information in some scenarios. Or, perhaps the UX design team intentionally decided that mentioning the Twitter username associated with the email address would be a "helpful" piece of info to present at this point in the login/signup flow. In this case, too, the design team should have known that privacy far outweighs any potential helpfulness.
• nilsbunger 4y ago
  I wonder if this will be the material adverse change that lets Elon get out of buying Twitter...
• bilekas 4y ago
  I would appreciate if they paid for a new phone number please... Oh and a new identity please. Thanks. But of course : They're sorry.
• robertlagrant 4y ago
  It's amazing how many security incidents are caused by people who are bad at acting.
• madrox 4y ago
  Tying identity to a phone number is one of those things that solved an immediate need (2FA) but it's riddled with so many issues and concerns that the only reason we're still doing it is because the alternatives are a huge step up in complexity and user frustration. It's why I've been relatively ok with everything Apple has been doing here. Someone needs to drag us into the modern age of authentication and it hasn't been any standards body. They can write specs all day but unless they can get players to adopt them then they're worthless. It's Netscape 3.0 all over again.
• tdehnel 4y ago
  Anyone else annoyed by the growing use of the word "impact" to speak increasingly passively? People are so afraid to make a claim nowadays, even if it's obviously true. They speak of "impacts" or that something will be "impacted". But they seem to want to avoid saying who or what will be impacted. "I was impacted by today's layoffs." "We expect there to be impacts to website traffic." These meaningless words do nothing except to say "something has happened" which puts the reader in the mindset of having to unravel a mystery. Anytime you write it's your job to make yourself understood. I don't want to have to be Encyclopedia Brown to figure out what you're trying to tell me. https://books.google.com/ngrams/graph?content=impacting&year_start=1800&year_end=2019&corpus=26&smoothing=3&direct_url=t1%3B%2Cimpacting%3B%2Cc0 https://books.google.com/ngrams/graph?content=impacting&year... Edit: A better headline for OP would have been "Private phone numbers + email addresses leaked for 5M Twitter accounts"
  • ben174 4y ago
    Exactly. They're giving the least information possible to formulate a coherent headline which is technically accurate. If they told the truth in the headline, it would get WAY more clicks. These are clicks they don't want.
  • whydid 4y ago
    Head wobble
  • aquaduck 4y ago
    Orwell's "Politics and the English Language" really should be required reading for all high school students. Personally, I re-read it every few years - chronic exposure to terrible English makes the bad habits grow back, so you need to pull the weeds regularly.
  • deleted 4y ago
    [deleted]
• jonahbenton 4y ago
  I thought this was going to be a tongue in cheek announcement to wit- A chaos actor with malintent executed a social engineering attack and thereby acquired sensitive private data from several million active human accounts with the goal we believe to misclassify humans as bots and thereby thwart the actor's own publicly but impulsively stated goal of acquiring Twitter and becoming custodian of this data. This actor is still at large though we expect to see him in Delaware Chancery Court in September where he will be punished for his impulsive chaos.
• femiagbabiaka 4y ago
  I've stopped using twitter.com for consumption of tweets and only user nitter.net now. It works most of the time. If your use case for twitter is similar to mine, read-only, it may be useful for you as well.
• quickthrower2 4y ago
  Another nail in the coffin for phone numbers? Useless for security, most calls are scams now (friends/family use other tech to communicate), and now leaked enough that everyone knows everyone's number anyway.
• jheriko 4y ago
  Almost as bad as the child porn and flagrant criminality... Almost
• i_have_an_idea 4y ago
  Facebook had a very similar information leak just a couple of years ago. It is amazing these companies seem to learn very little from each other when it comes to protecting personal information.
  • jlarocco 4y ago
    And look how bad it turned out for them...
• nomilk 4y ago
  > If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. First time I've heard a company actually say this. It's obvious to people who understand a bit about tech and security, but not obvious to the layperson. Twitter actually deserve a tiny amount of credit for giving practical advice that reduces adversity for users in the event of a breach.
  • civilized 4y ago
    Except for a long time they shut down accounts without a phone number under the pretense of "suspicious activity". For some reason, these suspicions could be immediately allayed only by providing your phone number. Being forced to do something and later being advised not to do that thing out of deep concern for my well-being? Yeah, that's the Twitter UX vibe: the most self-regarding, passive-aggressive person you know, in software form.
  • rbut 4y ago
    No, that's just shifting the blame onto the user. If they are asking for something as sensitive as a mobile number, then they need to protect it properly. They ask for a mobile number to verify you're a real human, then they say "Ha it's your fault you gave us a sensitive mobile number". 99.9% of users only have one mobile, and have no idea how to get an alternate number, so they just give the number they have.
    • nomilk 4y ago
      > that's just shifting the blame onto the user. Even so, it's the first time I've seen a company actually imply to the public in plain English that they can't protect private info, rather than maintain a facade of security that doesn't actually exist. As you point out though, if Twitter requires a phone number to sign up and 99.9% of users use their personal number, then Twitter are basically saying "our security sucks and if you want an account you have no alternative...". Some interesting corollaries: - Are there any services that will sign up to twitter on behalf of users? (and would they work or would it be merely shifting trust from Twitter to a potentially less trustworthy party?) - I wonder if Twitter could consider not requiring personal info at sign up so as to avoid this dark UX - Is there a 10 minute mail for phone numbers?
• soheil 4y ago
  > To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. What? How? Twitter doesn’t allow voip numbers or any sms gateway that is not a brick and mortar teleco company that requires full ID verification.
• lumost 4y ago
  You know... in the last major tech bust, downsized teams working on oversized software didn't have thousands of productions services to maintain. What's a company with 10k services, and 10 languages going to do when when it comes time to patch security vulnerabilities. Or merely keep them from emerging?
  • 1-6 4y ago
    Put together a ‘scrappy team’ no longer sounds professional and sustainable.
• remram 4y ago
  > we recommend not adding a publicly known phone number or email address to your Twitter account. > While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication I think those things are incompatible, or at least Twitter really gives that impression. Great recommendation /s
  • tomjakubowski 4y ago
    How are those things incompatible?
  • stygiansonic 4y ago
    The full sentence states: While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication using authentication apps or hardware security keys to protect your account from unauthorized logins. So it actually does not imply adding a phone number, which is seemingly what you have tried to imply with the cut-off quote provided.
    • hackernewds 4y ago
      Intentional drudgery? inconceivable!
    • exodust 4y ago
      > "it actually does not imply adding a phone number" It actually does. The sentence you quoted contains the link "enable 2-factor authentication", which goes to a page where adding a phone number is the FIRST method described. "There are three methods to choose from: Text message, Authentication app, or Security key..... If you don’t already have a phone number associated with your account, we’ll prompt you to enter it."
  • deleted 4y ago
    [deleted]
• EGreg 4y ago
  Every time, it's the same story: https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says-only-industry-where-this-regularly-happens/ https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says...
• cnst 4y ago
  Anyone's keeping track of Twitter's supposed promise to not use phone numbers outside of 2FA? IIRC, this is at least a third email / phone number dataleak bug that they have.
• reshie 4y ago
  seems more about doxing and in this case large scale. being able to attach identities to numbers. as for brut forcing I'm sure they have limited attempts among other measures.
• ngcc_hk 4y ago
  Twitter has 2 factors. Turn it on. Then not just phone.
• tylerdurden91 4y ago
  > "At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. " This sounds misleading or incompetent. If someone was harvesting data, then logs would indicate how many such login attempts were being made per second/minute/hour/day and the activity would spike in certain days, times, geographical areas to suggest this kind of activity is going on. Even if the attacker was really careful spreading their activity over long periods of time & routing it via multiple geographical areas, the overall activity would show an uptick before & after the bug. I find it highly unlikely that a company of the size of Twitter could not ascertain from their internal data that a bug like this was exploited or not.
• vinay_ys 4y ago
  I have seen too many services that ask phone number for account recovery purposes and then end up using it for other purposes for which the user didn't consent. Given how insecure SMS OTP is, I try not to enable that if I can avoid it. Then, on top of it, bugs like this make the service behave like a globally accessible open reverse-directory of mobile numbers to names. How is twitter notifying users? Has anyone posted screenshots of this notification? I want to know where this notice will appear.
  • spurgu 4y ago
    Not defending them but I think a major reason why Twitter (and for example Gmail nowadays) is asking for phone numbers is to decrease spam accounts (which is of course a good thing in itself).
    • switch007 4y ago
      How did they arrive at phone numbers? What other options did they try. It’s too easy to give companies a pass “because spam”
      • spurgu 4y ago
        As I said, not defending them. They are likely doing dozens of other things as well. But using phone numbers is a quite effective method of hindering spam/bot account creation - in most countries in Europe at least getting a prepaid SIM requires ID nowadays. Not that Twitter would go as far as to inquire ownership records of phone numbers... but/so you could still go and buy 100 SIM cards if you wanted to, but it'd be way more expensive than just spawning new email addresses.
        • mccorrinall 4y ago
          No spammer ever buys sim cards in store with ID. 5sim.net apparently has direct SS7 access and nearly infinite numbers and offers bulk purchases for receiving SMS. Even for countries like Germany, where ID authentication is mandatory to get a phone number. They have thousands of +49 numbers. Costs only a few rubles. If you convert it to euros it’s between 1-10 cents, depending on the service and country. The bottom line is: IDs for sim cards are useless.
• ivxvm 4y ago
  Isn't this widely known and very old trick? I'm pretty sure I even saw youtube tutorials and non-techy people discussing there is a way to find a person's twitter account by their number. This article says like it's something recent that was only available for short time and quickly fixed. Doesn't seem like that at all.
• thimkerbell 4y ago
  Twitter by default lets you compose, but not send, a direct message to someone who doesn't follow you. Then Twitter leans on you to give them your phone number, and won't send it unless you do.