News for hackers. Stuff that matters.
Re:Parler Databases Disclosed by beerandt on Monday January 11, 2021 @05:24AM (#25727004)
That, or Twillio was reporting authenticated emails, without actually authenticating them?

It seems to involve some skipped auth steps on someones part though, not just a fail-safe/fail-dead mixup. It's not clear.

Re:Parler Databases Disclosed by myaccount275 on Monday January 11, 2021 @06:27AM (#25727530)
Maybe Parler was deciding based on HTTP status codes returned from the Twilio API, or the presence of some expected "error" field in the response (if it's not there, consider it ok), and one side screwed up the handling of an unexpected case? Pure speculation.

Instead of having "if explicitly ok, proceed", they maybe had "unless it's an explicit negative response in an expected format (or a connectivity issue, timeout, etc.), proceed"?

Which would be a pretty dumb thing to do, but I've seen worse.