4 ms·

It's not far fetched to say a Senator's pilot could drop their airplane into the Delaware. It's not far fetched to say a the line cook at a Senator's restauran

It's not far fetched to say a Senator's pilot could drop their airplane into the Delaware. It's not far fetched to say a the line cook at a Senator's restaurant could poison their food. It's not far fetched to say that a Senator's financial advisor could run off with their money. It's not far fetched to say the teachers who instruct a Senator's kids could fill their heads with lies. Humans have all sorts of ways to wreak destruction on one another but it mostly doesn't happen, and when it does, we have many, many systems in place to detect and punish. And we tend to scale the weight of these systems to the size of the perceived threat - that's why doctors and pilots are more burdened than bankers who are more burdened than cooks. How likely is someone to actually take over these accounts (what's to gain)? How much damage would it do (not too much, people get hacked on Twitter all the time and that's baked in to the credulity of each tweet)? How likely is that employee to get caught (high), and how much punishment would they face (huge fines, possible jail time, unemployable in many industries for the rest of their lives). Technical safeguards are not our only safeguards, especially for insider threats, which long predate the Internet. External hackers do dramatically change the calculus here (unlikely to get caught or punished) but that's not what's being alleged.

pclmulqdq 4y ago
Technical safeguards against insider threats do not actually protect you from insider threats - the fact that your behavior is logged and you will get fired and sued into oblivion works very well. Technical safeguards against insider threats protect your insiders. They give your insiders cover in situations where they might be coerced to do things. When I was at G, I likely could have read some data from cloud customers with some social engineering and the permissions I had. It would have taken hours to get the first byte, and I would have been fired within 10 minutes if I did without a good reason. The fact that it would have taken hours and some social engineering would let me plausibly tell the police (or the Chinese government or the mob or anyone else), "no, I don't have access to that data." Twitter's engineers didn't have that cover.
- bink 4y ago
  Not to defend Twitter because their lack of oversight and security controls around who can access what sounds completely inadequate and borderline criminal... but comparing any company to Google is unfair. Very, very few companies have the resources and experience that Google has dealing with these types of threats.
- MattPalmer1086 4y ago
  I like your take on it providing cover for insiders against coercion. I hadn't considered that aspect before. I'd slightly disagree that technical safeguards don't provide any protection against insider attacks. But yes, the deterrent effect of having a high chance of being caught is very effective.
- sangnoir 4y ago
  Weren't those controls added after some Googler stalked teenagers[1] via their chats for months? That event generated bad publicity in the press, and some years later, the same thing happened at Uber, with the euphemism "LoveOPS" being used, IIRC. High-growth companies prefer to prioritize features and kick the access control can down the lane until they absolutely have to. Without looking at revenue and employee numbers, I suspect 2010 Google and 2016-ish Uber are comparable to current Twitter, IMO. Edit: the Googler story is far worse that I remembered: he had unfettered access to underaged victims' mailboxes, chat logs, contacts and Voice accounts and used that information to taunt one victim, and unblocked himself from another victim who had blocked him on Gchat - Google only became aware of it when it was reported externally. 1. https://www.businessinsider.com/google-engineer-stalked-teens-spied-on-chats-2010-9?amp https://www.businessinsider.com/google-engineer-stalked-teen...
  - pclmulqdq 4y ago
    That incident inspired the alerts and the permissions checks. There were a few other incidents (not heinously bad if they were public, but potentially bad for G) that made them go all the way.
michaelt 4y ago
> It is not far fetched to say a Senator's pilot could drop their airplane into the Delaware. Aviation has the state imposing licensing requirements, the state certifying which vehicles can take passengers, the state imposing technical requirements like transponders, the state investigating accidents, the state telling pilots when they can take off and land, the state searching passengers' luggage and sending them shuffling through scanners without their shoes, the state establishing no-fly lists, and the state wading into the industry and choosing winners and losers whenever it's geopolically convenient. If you tell the senate you'd like the tech industry to be regulated no more heavily than the aviation industry we'd be in for a lot more regulation.
- bradleybuda 4y ago
  > [...] we tend to scale the weight of these systems to the size of the perceived threat - that's why doctors and pilots are more burdened than bankers who are more burdened than cooks
madeofpalk 4y ago
> How likely is someone to actually take over these accounts? How much damage would it do? We kind of have answers to these questions already: - A rogue employee/contractor deactivated Trump's account back in 2017 https://www.theguardian.com/technology/2017/nov/03/experts-warn-about-security-after-donald-trumps-twitter-account-briefly-deleted https://www.theguardian.com/technology/2017/nov/03/experts-w... - "130 high-profile Twitter accounts [including Apple, Barack Obama, Joe Biden, and Bill Gates] were compromised by outside parties to promote a bitcoin scam" using internal Twitter admin tools. https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking The impact of both of these was basically zero.
- tschwimmer 4y ago
  Is it true that the impact of these incidents was zero? How much money did the bitcoin scam guys get?
- saltminer 4y ago
  There's also the fact that entire forums exist around selling accounts (or access to accounts). One such site, swapd.co, has a pinned post for Twitter "username claims" and "account recovery", among other things. This site has sold admin panel access that has been responsible for a lot of crypto scams [0] in the past. Nobody's account is safe. Doesn't matter what 2FA methods you use, whether you're verified or not, how many followers you have, all it takes is a couple grand for someone else to take it over. > The impact of both of these was basically zero. Per the Wikipedia article you linked, the attackers got $110k in Bitcoin, which is not "basically zero" (even if the price of BTC has fallen since then). [0]: https://www.web3isgoinggreat.com/?id=researcher-zachxbt-alleges-that-teenager-who-stole-crypto-worth-37-million-in-2020-is-responsible-for-a-spate-of-crypto-related-twitter-hacks https://www.web3isgoinggreat.com/?id=researcher-zachxbt-alle...
  - ohgodplsno 4y ago
    If taking over more than 100, extremely high profile accounts with millions upon millions of followers only nets you 100k and puts massive visibility on you, it's basically zero.

pclmulqdq 4y ago

Technical safeguards against insider threats do not actually protect you from insider threats - the fact that your behavior is logged and you will get fired and sued into oblivion works very well. Technical safeguards against insider threats protect your insiders. They give your insiders cover in situations where they might be coerced to do things. When I was at G, I likely could have read some data from cloud customers with some social engineering and the permissions I had. It would have taken hours to get the first byte, and I would have been fired within 10 minutes if I did without a good reason. The fact that it would have taken hours and some social engineering would let me plausibly tell the police (or the Chinese government or the mob or anyone else), "no, I don't have access to that data." Twitter's engineers didn't have that cover.

bink 4y ago
Not to defend Twitter because their lack of oversight and security controls around who can access what sounds completely inadequate and borderline criminal... but comparing any company to Google is unfair. Very, very few companies have the resources and experience that Google has dealing with these types of threats.
MattPalmer1086 4y ago
I like your take on it providing cover for insiders against coercion. I hadn't considered that aspect before. I'd slightly disagree that technical safeguards don't provide any protection against insider attacks. But yes, the deterrent effect of having a high chance of being caught is very effective.
sangnoir 4y ago
Weren't those controls added after some Googler stalked teenagers[1] via their chats for months? That event generated bad publicity in the press, and some years later, the same thing happened at Uber, with the euphemism "LoveOPS" being used, IIRC. High-growth companies prefer to prioritize features and kick the access control can down the lane until they absolutely have to. Without looking at revenue and employee numbers, I suspect 2010 Google and 2016-ish Uber are comparable to current Twitter, IMO. Edit: the Googler story is far worse that I remembered: he had unfettered access to underaged victims' mailboxes, chat logs, contacts and Voice accounts and used that information to taunt one victim, and unblocked himself from another victim who had blocked him on Gchat - Google only became aware of it when it was reported externally. 1. https://www.businessinsider.com/google-engineer-stalked-teens-spied-on-chats-2010-9?amp https://www.businessinsider.com/google-engineer-stalked-teen...
- pclmulqdq 4y ago
  That incident inspired the alerts and the permissions checks. There were a few other incidents (not heinously bad if they were public, but potentially bad for G) that made them go all the way.

michaelt 4y ago

> It is not far fetched to say a Senator's pilot could drop their airplane into the Delaware. Aviation has the state imposing licensing requirements, the state certifying which vehicles can take passengers, the state imposing technical requirements like transponders, the state investigating accidents, the state telling pilots when they can take off and land, the state searching passengers' luggage and sending them shuffling through scanners without their shoes, the state establishing no-fly lists, and the state wading into the industry and choosing winners and losers whenever it's geopolically convenient. If you tell the senate you'd like the tech industry to be regulated no more heavily than the aviation industry we'd be in for a lot more regulation.

bradleybuda 4y ago
> [...] we tend to scale the weight of these systems to the size of the perceived threat - that's why doctors and pilots are more burdened than bankers who are more burdened than cooks

madeofpalk 4y ago

> How likely is someone to actually take over these accounts? How much damage would it do? We kind of have answers to these questions already: - A rogue employee/contractor deactivated Trump's account back in 2017 https://www.theguardian.com/technology/2017/nov/03/experts-warn-about-security-after-donald-trumps-twitter-account-briefly-deleted https://www.theguardian.com/technology/2017/nov/03/experts-w... - "130 high-profile Twitter accounts [including Apple, Barack Obama, Joe Biden, and Bill Gates] were compromised by outside parties to promote a bitcoin scam" using internal Twitter admin tools. https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking The impact of both of these was basically zero.

tschwimmer 4y ago
Is it true that the impact of these incidents was zero? How much money did the bitcoin scam guys get?
saltminer 4y ago
There's also the fact that entire forums exist around selling accounts (or access to accounts). One such site, swapd.co, has a pinned post for Twitter "username claims" and "account recovery", among other things. This site has sold admin panel access that has been responsible for a lot of crypto scams [0] in the past. Nobody's account is safe. Doesn't matter what 2FA methods you use, whether you're verified or not, how many followers you have, all it takes is a couple grand for someone else to take it over. > The impact of both of these was basically zero. Per the Wikipedia article you linked, the attackers got $110k in Bitcoin, which is not "basically zero" (even if the price of BTC has fallen since then). [0]: https://www.web3isgoinggreat.com/?id=researcher-zachxbt-alleges-that-teenager-who-stole-crypto-worth-37-million-in-2020-is-responsible-for-a-spate-of-crypto-related-twitter-hacks https://www.web3isgoinggreat.com/?id=researcher-zachxbt-alle...
- ohgodplsno 4y ago
  If taking over more than 100, extremely high profile accounts with millions upon millions of followers only nets you 100k and puts massive visibility on you, it's basically zero.