An update on our security incident

Re:An update on our security incident by geocar on Friday July 31, 2020 @02:52AM (#24006319)

You have a need for a tool allows you to see the UI “as the user does” so you can respond to support requests and maybe someone thinks it’s easier to just copy the cookie.

This isn’t the right way to do it, but given they work at Twitter I could imagine this isn’t the first big mistake they’ve made.

[ Parent | on HN ]

Re:An update on our security incident by Thorrez on Friday July 31, 2020 @04:01AM (#24006672)

This sounds like speculation. Is there evidence that Twitter has a tool that allows employees to see the UI as the user does?

[ Parent | on HN ]

Re:An update on our security incident by geocar on Friday July 31, 2020 @04:34AM (#24006834)

The question was interpreted as “why do admin tools have these features” on account of that was in the first sentence, and not, as you may have imagined, a request for a twitter employee to explain all of their tools, or a request for a twitter employee to justify creating these tools.

[ Parent | on HN ]

Re:An update on our security incident by onefuncman on Friday July 31, 2020 @04:26AM (#24006797)

it's not copying the cookie, but there are absolutely third party UIs via a user's API key, it's not a huge leap of faith to assume Twitter has similar internally.

[ Parent | on HN ]

Re:An update on our security incident by Thorrez on Friday July 31, 2020 @04:44AM (#24006882)

A tool that allows an employee to access a user's API key? That sounds like a bad idea, especially if that tool is accessible to support personnel.

[ Parent | on HN ]