4 ms·

This is obviously fake. As tech-savvy users, you should easily be able to verify this. The subdomain cannot resolve as it does not have a valid cert, and okta

by m00x 2y ago

This is obviously fake. As tech-savvy users, you should easily be able to verify this. The subdomain cannot resolve as it does not have a valid cert, and okta does not have an API to do this. Come on fellas, do better.

mmmegan 2y ago
twitter.okta.com cert: openssl s_client -connect twitter.okta.com:443 CONNECTED(00000006) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify return:1 depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 verify return:1 depth=0 C = US, ST = California, L = San Francisco, O = "Okta, Inc.", CN = .okta.com verify return:1 write W BLOCK --- Certificate chain 0 s:/C=US/ST=California/L=San Francisco/O=Okta, Inc./CN=.okta.com i:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1 1 s:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1 i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA ---
- robswc 2y ago
  that's not the url though. the sub-domain in the image is "protected-users" - which makes no sense, btw.
  - beeflourishing 2y ago
    the screenshot for sure is fake. But that twitter Okta subdomain (twitter.okta.com) isn't. I got redirected to some twitter.biz site when I went to the Okta URL on my phone. and then got a cloudflare message saying I got blocked. I did some more digging. there is a SOA record for twitter.biz which says noc.twitter.com is responsible for it. DATA: a.u09.twtrdns.net. noc.twitter.com. 2023050934 3600 600 604800 60 MNAME: a.u09.twtrdns.net. RNAME: noc.twitter.com. Serial: 2023050934 Refresh: 1 hour Retry: 10 minutes Expire: 7 days TTL: 1 minute
    - wlonkly 2y ago
      Sure, that means Twitter probably uses Okta for corporate SSO (as do many companies), but nothing more. Okta offers white-labeling on your own domain (and some advanced Okta features are only available via white-labeling), so twitter.biz is probably their corporate domain. (that's noc @ twitter.com, by the way, the RNAME is an email address where you replace the leftmost dot with an @.) Be careful with "that subdomain", though -- beeflourishing.okta.com also resolves, they've probably got a wildcard DNS entry and definitely have a wildcard SSL cert there. None of that is evidence of this thing.
flykespice 2y ago
If they are fake why were they so quick to ban the leakers? They would let Community Notes do their job, something tells me they panicked. Regardless, there definitely exists a hidden whitelisting to "protected users" spread their hatred, otherwise accounts like this that explicitly use slurs (https://twitter.com/NsPostingFs https://twitter.com/NsPostingFs) would be banned long ago.

by m00x 2y ago

mmmegan 2y ago

twitter.okta.com cert: openssl s_client -connect twitter.okta.com:443 CONNECTED(00000006) depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA verify return:1 depth=1 C = US, O = DigiCert Inc, CN = DigiCert TLS RSA SHA256 2020 CA1 verify return:1 depth=0 C = US, ST = California, L = San Francisco, O = "Okta, Inc.", CN = .okta.com verify return:1 write W BLOCK --- Certificate chain 0 s:/C=US/ST=California/L=San Francisco/O=Okta, Inc./CN=.okta.com i:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1 1 s:/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1 i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA ---

robswc 2y ago
that's not the url though. the sub-domain in the image is "protected-users" - which makes no sense, btw.
- beeflourishing 2y ago
  the screenshot for sure is fake. But that twitter Okta subdomain (twitter.okta.com) isn't. I got redirected to some twitter.biz site when I went to the Okta URL on my phone. and then got a cloudflare message saying I got blocked. I did some more digging. there is a SOA record for twitter.biz which says noc.twitter.com is responsible for it. DATA: a.u09.twtrdns.net. noc.twitter.com. 2023050934 3600 600 604800 60 MNAME: a.u09.twtrdns.net. RNAME: noc.twitter.com. Serial: 2023050934 Refresh: 1 hour Retry: 10 minutes Expire: 7 days TTL: 1 minute
  - wlonkly 2y ago
    Sure, that means Twitter probably uses Okta for corporate SSO (as do many companies), but nothing more. Okta offers white-labeling on your own domain (and some advanced Okta features are only available via white-labeling), so twitter.biz is probably their corporate domain. (that's noc @ twitter.com, by the way, the RNAME is an email address where you replace the leftmost dot with an @.) Be careful with "that subdomain", though -- beeflourishing.okta.com also resolves, they've probably got a wildcard DNS entry and definitely have a wildcard SSL cert there. None of that is evidence of this thing.

flykespice 2y ago

If they are fake why were they so quick to ban the leakers? They would let Community Notes do their job, something tells me they panicked. Regardless, there definitely exists a hidden whitelisting to "protected users" spread their hatred, otherwise accounts like this that explicitly use slurs (https://twitter.com/NsPostingFs https://twitter.com/NsPostingFs) would be banned long ago.