> this leaves a really bad taste with how Twilio handled the situation AS A BUSINESS.

I wouldn't blame Twilio. It's entirely Parler's fault they allowed an unvalidated account to successfully register and log in.

Of course, it's also entirely the intruder's fault they exploited the wide open security hole.

Agreed. It’s a bit of column A and column B. Twilio shouldn’t have disclosed the services that Parler were using. Parler should not have allowed unverified users to log in ESPECIALLY if they’re dealing with PII. (Verified Parlers submitted photos of their licenses.)

Either way, this feels like something that will end in a lawsuit.

I doubt Parler will survive long enough.

Tagging onto the top comment here. I work at Twilio and this is our official statement on the enforcement of our AUP with Parler.

---

With regards to reports of cyber security issues Parler experienced and have been attributed to Twilio, our security team investigated the claims and found no evidence indicating their security issues were related to Twilio or our products. Per our Website [0], Twilio has not issued any press releases pertaining to or referencing Parler.

Furthermore, Parler was using Twilio to send out identity verification codes for new downloads or password resets. Once a user was verified, security protocols were independently handled by Parler and did not involve Twilio or its products. On Friday, January 8th, we sent Parler a letter informing them they were in violation of our Acceptable Use Policy [1] and notifying them that we would suspend their account if they did not make efforts to remediate multiple calls for violence on their platform. Shortly after receiving our letter, Parler informed us they had already turned off their integration with Twilio.

Any cyber security issues experienced by Parler were completely unrelated to Twilio or any of its products.

[0] https://www.twilio.com/press/releases

[1] https://www.twilio.com/legal/aup

I would hold off judging Twilio based on a random anonymous reddit post's account

Did Twilio actually make this alleged press release? There is nothing like that on https://www.twilio.com/press/releases

I have the same question about the press release. Where was it posted and what was its content?

I know that not all press statements are going to be on the website.

I have no idea about what twilio did, as this is all completely unrelated to any work I've ever done, so that leads me to wonder about contingencies like this in general.

From the perspective of any company using a service like twilio (i.e., not just Parler and this specific set of events), would there not be some sort of failsafe in case something just like this were to happen? Or would this kind of thing be so nearly inconceivable that you wouldn't protect against it?

There's two ways to react if an API you're using for authentication type stuff is down:

* Fail and essentially have downtime on the features using the API

* Succeed and essentially have no authentication for that time but no downtime

Parler took the second approach. Platforms that value security would take the first approach.

> Because Twilio was no longer authenticating emails.

Can someone explain what does this mean?

Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.

Maybe it was more complex: Create new acct 1 using valid email. Request users by username and see privilege. Find likely phone # and likely email for user : arroganttechfounder1 (admin). Create new acct 2 using likely phone number (fail, account exists). Change (add) new acct 1 phone # to match likely phone number (normally, the twilio validation step here would prevent duplicate phone numbers for multiple accounts?). Request pw reset for phone number (pw reset key saved to both accts?), no sms sent. Request pw reset for email (new acct 1) and logic sees non-expired key from previous request, emails you same key. Modify url to reset pw for arroganttechfounder1 using phone # and key.

> And somehow, without access to Twillio's API, they defaulted to not do any check at all?

I guess you could imagine user accounts being created with `authenticated=null`, and then having `authenticated=False|True` set in the in the success handler for some Twillio API call. Having null as the default would allow you to see in the database where authentication emails hadn't been sent out, so you could resend them.

And then I guess you could imagine a developer checking authentication by looking for cases where `!authenticated`, rather than `authenticated == True`. Granted I don't think this hack is real, but if it were then that's probably how it would play out.

That, or Twillio was reporting authenticated emails, without actually authenticating them?

It seems to involve some skipped auth steps on someones part though, not just a fail-safe/fail-dead mixup. It's not clear.

Maybe Parler was deciding based on HTTP status codes returned from the Twilio API, or the presence of some expected "error" field in the response (if it's not there, consider it ok), and one side screwed up the handling of an unexpected case? Pure speculation.

Instead of having "if explicitly ok, proceed", they maybe had "unless it's an explicit negative response in an expected format (or a connectivity issue, timeout, etc.), proceed"?

Which would be a pretty dumb thing to do, but I've seen worse.

> they defaulted to not do any check at all?

That would be a very unsafe default.

They wanted more users to register - they were urging users to invite friends and family - so they may have changed the safe default to the unsafe one thinking on verifying later without realizing the full consequences of what they did.

Nope it was totally realistic.

I tried to create an account on Parler last night to check which services were turned off by AWS. I entered dummy data into their form. The POST to their auth service timed out...but the auth flow took you to the success page anyway?

It's basically the scenario Tom Scott laid out about what would happen if Google stopped checking passwords... except it happened to Parler.

https://www.youtube.com/watch?v=y4GB_NDU43Q

The description doesn't really make any sense. Did everything just fail open? I would assume that if your SMS/Email service stopped working then it would just be that nobody could login or sign up.

> Did everything just fail open?

That seems to be the consensus.

BTW, where is that Press Release? Can't find it on the Twilio website.

"accidentally"

Just a disclaimer, in case anyone has forgotten about the great ion cannon from back in the day:

If any of these Twitter or Reddit posts are true then I would talk to a lawyer before participating.

That is just a list of parler public urls.

The URL lists were used to distribute archiving of media content. 70TB of text, image, video, and metadata content was downloaded in a few hours with essentially a volunteer botnet.

The team at archive.org is importing the full archive right now.

I don't know about that's Only that the FBI is creating their nofly lists based on it.

You said it nicely. At the end of the day, we all look after ourselves the most, and one cannot avoid thinking what if this happened to our company?

Twilio as a B2B doesn't gain a lot from being a "woke" company and following the trend of lynching Parler, on the contrary this can and will scream how Twilio can put your whole platform down overnight..

I wonder when are we going to see a legal discussion if / when internet access is going to become a basic human right? Just like electricity became ubiquitous, I expect internet access (email, payment processing, etc) to also become a right.

>> I wonder when are we going to see a legal discussion if / when internet access is going to become a basic human right? Just like electricity became ubiquitous, I expect internet access (email, payment processing, etc) to also become a right.

Is electricity a right?

In a way, yes (even in the US). You still have to pay for it, but there is a litany of rules and procedures they must follow before they can cut you off. Kind of like the foreclosure process.

They can't cut a customer's power over his politics--especially paying customers!

Electricity is a public utility, not a right. A public utility is a regulated entity that must supply anyone in their region who follows the rules -- and, in general, if you break the rules but then fix your behavior, they must allow you service again. The existence of a public utility does not forbid a private competitor, but the scale advantage of a public utility is generally overwhelming unless you have specialized needs.

It is reasonable to suggest that Internet bandwidth should be a public utility.

It would be useful to clarify what "follow the rules" here means, in the USA (for us non-USA audiences). It probably varies in different countries, but in most cases doesn't it simply refer to fair usage? Make your payments in time and don't put excessive strain on the grid by powering your inter-dimensional portal. Does ideology or clandestine activity matter in how you use electricity? Of course, a court order could force the utility company to cut you off, but can the utility company simply cut you off based on their or society's _opinion_ of your activities?

If you consider an internet connection a public utility, which we should, then that would be ostracism. In terms of companies being able to successfully run their businesses, are we at the point where a "cloud provider" should be considered part of a country's infrastructure?

I can agree with the point being made about an internet connection, but Parler was still able to buy some servers and self-host. Unless there's an argument here to consider cloud providers a de-facto component of a nation's tech infrastructure. Seeing as we have no proper public regulation of the sector and no public player providing the service, I'm not sure how far that argument would go. It's still an interesting question to ponder on, I guess.

ISPs, CDNs, domain registrars, DNS, etc. have all cut off services to sites that they consider in violation of their user agreements (which mostly boil down to you've become a liability for us). If you've annoyed enough people, you can pretty much get booted off the Internet--especially if you need enough infrastructure, data, authentication, etc. that you can't easily just force people into a game of whack-a-mole.

iirc a county in california recently switched off some youtubers' electric because they were hosting big get togethers despite social distancing rules. which seems to go a bit beyond fair usage. not sure if it was 100% legally sound, but they probably had to be at least reasonably confident in the move, since they could reasonably expect PR

Not in the US, no.