Stupid questions: Did the attacks involve a duped Twitter employee changing high-value account emails? Without a second person reviewing? And wouldn't PCI have something against that?

PCI is about payment cardholder data (credit card data). So, no, cause Twitter is free and you are not sending credit card data to them. However, if you applied the principals of PCI to all user data then possibly yes. The more valuable practice would be anti-phishing training for CS employees.

Anti-phishing training (and PCI in general) has made very little difference in my experience as a practitioner. Like most security remedies, there is no data to back up its efficacy, and no standard for how it should be done.

> However, if you applied the principals of PCI to all user data then possibly yes.

Yes, that is the charitable interpretation you could have safely assumed I meant.

So far it seems it did involve a Twitter employee: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-ac...

>And wouldn't PCI have something against that?

AFAIK (the spec is huge) PCI-DSS doesn't have a two-man rule requirement. Twitter is arguably doing everything PCI-DSS requires as its good security hygiene anyways.

A single duped employee changing dozens of accounts emails? A dozen of duped employees? This feels very unlikely. Some sort of admin tool must have been used.

I know the admin tool was involved (at least from the reports). I mean that an external party masquerading as legit users was duping employees into changing that stuff (possibly via the admin tool).

I'd love to be a part of that postmortem, and perhaps a new compliance standard could be formed if root cause turns out to be a technical shortcoming.