News for hackers. Stuff that matters.

A comment on Twitter says an attacker used its API to match usernames to phone numbers. Parent comment

Re:Twitter says an attacker used its API to match usernames ... by fireattack on Wednesday February 05, 2020 @02:32PM (#22250224)
> If you say no, twitter asks again and again every day / every login until you finally allow it to.

Any proof about this claim? I use Twitter on Android and web frequently and I only refuse such request once or twice.

Bottom line, it doesn't "ask again and again every day".

[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by throwiay987 on Wednesday February 05, 2020 @02:51PM (#22250388)
Consider yourself lucky, any account i create without a phone is immediately flagged\blocked and if i do use mine(personal), i get asked to add permissions like the parent said every single time.
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by fireattack on Wednesday February 05, 2020 @03:08PM (#22250515)
Account associated with a phone number is totally different from "scan your contacts".
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by zippergz on Wednesday February 05, 2020 @04:14PM (#22251047)
I've been using Twitter daily pretty much continuously since 2008 and I don't remember ever being prompted to upload contacts. I can believe it has happened at some point, but it certainly doesn't repeatedly ask me. I use the web interface and the first-party iOS app (though over the years I have also used various third-party apps on both iOS and macOS).
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by nacs on Wednesday February 05, 2020 @02:56PM (#22250430)
If you use the web client, they have a header that asks for your phone number repeatedly until you give it.
[ Parent | on HN ]
Re:Twitter says an attacker used its API to match usernames ... by fireattack on Wednesday February 05, 2020 @03:09PM (#22250522)
OP was talking about "Twitter asks to scan your contacts", not to add a phone number.
[ Parent | on HN ]