6 ms·

https://twitter.com/donie/status/1569695781631688704 https://twitter.com/donie/status/1569695781631688704 > "It's not far fetched to say an employee inside the

https://twitter.com/donie/status/1569695781631688704 https://twitter.com/donie/status/1569695781631688704 > "It's not far fetched to say an employee inside the company could take over the accounts of all the Senators in this room," @dotMudge with a warning here on Captiol Hill. #Twitter perhaps a valid reason?

codyb 4y ago
They probably have a way to take over accounts to check bug reports. We've had that at places I've worked. Where you'd be able to impersonate a user in order to see what was going on with their specific set of user data to corroborate their report and find a fix. The question is... are the permissions locked down, is access audited and immutable, etc I think.
- bombcar 4y ago
  Yep, there's lots of software with "su for X" capabilities; it's much better than the normal method which is "ok tell me your password and I'll login as you and see what's up".
AndrewStephens 4y ago
Well Duh! Of course a twitter employee could take over any account. Hopefully they have some internal safeguards in place but there are probably hundreds of people there that could take over an account if they wanted to, just as the owners of news.ycombinator.com could take over any account here. You don't really own a Twitter (or Facebook, or ycombinator) account. Those services have an account on you. You update their account on you when you use their service to post (and they keep other information useful to their business on your account that you have no access to). This is just the way social media works.
- michaelt 4y ago
  > Well Duh! Of course a twitter employee could take over any account. Most companies the size of Twitter would have a lot more controls than that on random employees' write access to production. If I want to assume a user's identity in my employer's production system I have to fill out a form justifying it, get my manager's approval for each account accessed, and my activity is subject to logging.
  - encryptluks2 4y ago
    So it can still be done, isn't that the original complaint?
  - madeofpalk 4y ago
    One would hope... ...on the other hand, https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking
  - themaninthedark 4y ago
    Remember when an employee took down Trumps account? https://news.yahoo.com/rogue-twitter-employee-took-down-141953762.html https://news.yahoo.com/rogue-twitter-employee-took-down-1419... First it was "inadvertently deactivated due to human error by a Twitter employee." Then "Through our investigation we have learned that this was done by a Twitter customer support employee who did this on the employee’s last day." It was kinda funny but you would expect that they would learn and improve from it. Edit: Thank you siblings for showing that it has continued to happen. Obviously not lesson not learnt.
Anon1096 4y ago
Was there an expectation of the opposite being true? You don't own a social media account. See all the people banned, shadowbanned, or who have had their @ handle or blue checkmarks taken from them. I thought it was accepted that the service provider can do whatever they want with a given account.
zamalek 4y ago
> perhaps a valid reason? That's why I specifically said "from a naive standpoint." I'm not arguing against valid reasons, I'm pointing out how absurd the situation is. From my comment: > I understand that there are consequences of Mudge's information
bradleybuda 4y ago
It's not far fetched to say a Senator's pilot could drop their airplane into the Delaware. It's not far fetched to say a the line cook at a Senator's restaurant could poison their food. It's not far fetched to say that a Senator's financial advisor could run off with their money. It's not far fetched to say the teachers who instruct a Senator's kids could fill their heads with lies. Humans have all sorts of ways to wreak destruction on one another but it mostly doesn't happen, and when it does, we have many, many systems in place to detect and punish. And we tend to scale the weight of these systems to the size of the perceived threat - that's why doctors and pilots are more burdened than bankers who are more burdened than cooks. How likely is someone to actually take over these accounts (what's to gain)? How much damage would it do (not too much, people get hacked on Twitter all the time and that's baked in to the credulity of each tweet)? How likely is that employee to get caught (high), and how much punishment would they face (huge fines, possible jail time, unemployable in many industries for the rest of their lives). Technical safeguards are not our only safeguards, especially for insider threats, which long predate the Internet. External hackers do dramatically change the calculus here (unlikely to get caught or punished) but that's not what's being alleged.
- pclmulqdq 4y ago
  Technical safeguards against insider threats do not actually protect you from insider threats - the fact that your behavior is logged and you will get fired and sued into oblivion works very well. Technical safeguards against insider threats protect your insiders. They give your insiders cover in situations where they might be coerced to do things. When I was at G, I likely could have read some data from cloud customers with some social engineering and the permissions I had. It would have taken hours to get the first byte, and I would have been fired within 10 minutes if I did without a good reason. The fact that it would have taken hours and some social engineering would let me plausibly tell the police (or the Chinese government or the mob or anyone else), "no, I don't have access to that data." Twitter's engineers didn't have that cover.
  - bink 4y ago
    Not to defend Twitter because their lack of oversight and security controls around who can access what sounds completely inadequate and borderline criminal... but comparing any company to Google is unfair. Very, very few companies have the resources and experience that Google has dealing with these types of threats.
armchairhacker 4y ago
The point is that politicians shouldn’t be posting their important messages on Twitter, but an official government channel. This was discussed in 2016

codyb 4y ago

They probably have a way to take over accounts to check bug reports. We've had that at places I've worked. Where you'd be able to impersonate a user in order to see what was going on with their specific set of user data to corroborate their report and find a fix. The question is... are the permissions locked down, is access audited and immutable, etc I think.

bombcar 4y ago
Yep, there's lots of software with "su for X" capabilities; it's much better than the normal method which is "ok tell me your password and I'll login as you and see what's up".

AndrewStephens 4y ago

Well Duh! Of course a twitter employee could take over any account. Hopefully they have some internal safeguards in place but there are probably hundreds of people there that could take over an account if they wanted to, just as the owners of news.ycombinator.com could take over any account here. You don't really own a Twitter (or Facebook, or ycombinator) account. Those services have an account on you. You update their account on you when you use their service to post (and they keep other information useful to their business on your account that you have no access to). This is just the way social media works.

michaelt 4y ago
> Well Duh! Of course a twitter employee could take over any account. Most companies the size of Twitter would have a lot more controls than that on random employees' write access to production. If I want to assume a user's identity in my employer's production system I have to fill out a form justifying it, get my manager's approval for each account accessed, and my activity is subject to logging.
- encryptluks2 4y ago
  So it can still be done, isn't that the original complaint?
- madeofpalk 4y ago
  One would hope... ...on the other hand, https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking
- themaninthedark 4y ago
  Remember when an employee took down Trumps account? https://news.yahoo.com/rogue-twitter-employee-took-down-141953762.html https://news.yahoo.com/rogue-twitter-employee-took-down-1419... First it was "inadvertently deactivated due to human error by a Twitter employee." Then "Through our investigation we have learned that this was done by a Twitter customer support employee who did this on the employee’s last day." It was kinda funny but you would expect that they would learn and improve from it. Edit: Thank you siblings for showing that it has continued to happen. Obviously not lesson not learnt.

Anon1096 4y ago

Was there an expectation of the opposite being true? You don't own a social media account. See all the people banned, shadowbanned, or who have had their @ handle or blue checkmarks taken from them. I thought it was accepted that the service provider can do whatever they want with a given account.

zamalek 4y ago

> perhaps a valid reason? That's why I specifically said "from a naive standpoint." I'm not arguing against valid reasons, I'm pointing out how absurd the situation is. From my comment: > I understand that there are consequences of Mudge's information

bradleybuda 4y ago

It's not far fetched to say a Senator's pilot could drop their airplane into the Delaware. It's not far fetched to say a the line cook at a Senator's restaurant could poison their food. It's not far fetched to say that a Senator's financial advisor could run off with their money. It's not far fetched to say the teachers who instruct a Senator's kids could fill their heads with lies. Humans have all sorts of ways to wreak destruction on one another but it mostly doesn't happen, and when it does, we have many, many systems in place to detect and punish. And we tend to scale the weight of these systems to the size of the perceived threat - that's why doctors and pilots are more burdened than bankers who are more burdened than cooks. How likely is someone to actually take over these accounts (what's to gain)? How much damage would it do (not too much, people get hacked on Twitter all the time and that's baked in to the credulity of each tweet)? How likely is that employee to get caught (high), and how much punishment would they face (huge fines, possible jail time, unemployable in many industries for the rest of their lives). Technical safeguards are not our only safeguards, especially for insider threats, which long predate the Internet. External hackers do dramatically change the calculus here (unlikely to get caught or punished) but that's not what's being alleged.

pclmulqdq 4y ago
Technical safeguards against insider threats do not actually protect you from insider threats - the fact that your behavior is logged and you will get fired and sued into oblivion works very well. Technical safeguards against insider threats protect your insiders. They give your insiders cover in situations where they might be coerced to do things. When I was at G, I likely could have read some data from cloud customers with some social engineering and the permissions I had. It would have taken hours to get the first byte, and I would have been fired within 10 minutes if I did without a good reason. The fact that it would have taken hours and some social engineering would let me plausibly tell the police (or the Chinese government or the mob or anyone else), "no, I don't have access to that data." Twitter's engineers didn't have that cover.
- bink 4y ago
  Not to defend Twitter because their lack of oversight and security controls around who can access what sounds completely inadequate and borderline criminal... but comparing any company to Google is unfair. Very, very few companies have the resources and experience that Google has dealing with these types of threats.

armchairhacker 4y ago

The point is that politicians shouldn’t be posting their important messages on Twitter, but an official government channel. This was discussed in 2016