News for hackers. Stuff that matters.
Re:Twitch source code and customer data has reportedly been ... by Semaphor on Wednesday October 06, 2021 @06:28AM (#28771348)
This is somewhat hilarious. Just 5 days ago I was complaining about Twitch’s new "Only verified users" setting which requires me to give them my phone number. One of the reasons I said I’ll not do that was "hacks, leaks". And now this. Sure, I’ll give you my phone number to add TOTP (Why even?) after I’ve just been shown how secure that data is.
Re:Twitch source code and customer data has reportedly been ... by AnIdiotOnTheNet on Wednesday October 06, 2021 @10:02AM (#28773312)
I don't really get this. My phone number is apparently already known by every scammer and spammer on earth, which is why I never answer calls from people I don't know, so what am I losing?

Meanwhile, Twitch has had a significant bot spamming problem.

Re:Twitch source code and customer data has reportedly been ... by Nextgrid on Wednesday October 06, 2021 @10:28AM (#28773597)
> so what am I losing?

The fact that they can use this number to correlate against contact lists collected from other people.

Now I don't think Twitch itself is doing this, but they may provide this information to marketing platforms such as Facebook which will use this data for ad targeting (and they definitely have a lot of people's contacts and can infer social graphs very well as a result).

Re:Twitch source code and customer data has reportedly been ... by slightwinder on Wednesday October 06, 2021 @04:34PM (#28778077)
> I don't really get this. My phone number is apparently already known by every scammer and spammer on earth, which is why I never answer calls from people I don't know, so what am I losing?

The only scammers who know my number are my phone-provider and my mom. Other scammers either never call me, or just don't know the number. Protecting your number is possible.

> Meanwhile, Twitch has had a significant bot spamming problem.

Which can be solved without this. The bot-problem is more about people not using the existing tools well and twitch sucking in their handling. Adding another features they won't use will not make anything better. Especially as the phone-number only rises the bar for bots.

Re:Twitch source code and customer data has reportedly been ... by AnIdiotOnTheNet on Wednesday October 06, 2021 @06:38PM (#28779358)
The twitch tools for dealing with spam suck ass. You basically get a blacklist of words and follower/subscriber only chat modes.
Re:Twitch source code and customer data has reportedly been ... by slightwinder on Wednesday October 06, 2021 @07:18PM (#28779710)
You can also restrict to following-age, certified e-mail, and some more. That experienced mods do have little to no problems with bot speaks kinda for itself. Additionally, there are also a bunch of requested features on twitch-side which could had defused the problems even more, without opening the privacy-box.
Re:Twitch source code and customer data has reportedly been ... by farmerstan on Thursday October 07, 2021 @10:22AM (#28786625)
Anyone who has your number in their contact list might have uploaded their entire contact list.

It literally takes only one person who has your number to reveal your number.

Re:Twitch source code and customer data has reportedly been ... by Semaphor on Wednesday October 06, 2021 @10:19AM (#28773498)
I’m also subscribed to a few channels. I’m pretty sure that is a far stronger signal that I’m not a bot than getting my phone number. And unlike most people, I only had 2 or 3 spam calls, and maybe 10 spam SMS on the number I’ve had for almost 20 years.
Re:Twitch source code and customer data has reportedly been ... by AnIdiotOnTheNet on Wednesday October 06, 2021 @12:59PM (#28775429)
Ok so you don't want them to have your phone number but you're ok with them having your payment details?
Re:Twitch source code and customer data has reportedly been ... by Semaphor on Wednesday October 06, 2021 @01:34PM (#28775861)
Pretty much my PayPal account, only.

And even otherwise, any fuckups there, my bank is liable. My phone number? Outside of changing my 20-year-old number, there’d be nithing I could do.

> And even otherwise, any fuckups there, my bank is liable. My phone number? Outside of changing my 20-year-old number, there’d be nothing I could do.

Re:Twitch source code and customer data has reportedly been ... by weberer on Wednesday October 06, 2021 @11:43AM (#28774506)
Which came first? You giving your phone number away online, or the scam calls?
Re:Twitch source code and customer data has reportedly been ... by zamadatix on Wednesday October 06, 2021 @12:10PM (#28774805)
Scam calls just end up ringing every working number these days and if you pick up even once you're already on the list of "real people". Targeted scamming of even just 100,000 potential victims is just wasted effort when with the same setup you could do untarget scamming of 100,000,000 potential victims.
Re:Twitch source code and customer data has reportedly been ... by iuri1 on Wednesday October 06, 2021 @03:01PM (#28776914)
Probably not everyone has disposable phone numbers or even know how to manage them, or even choose not to do it out of a personal decision
Re:Twitch source code and customer data has reportedly been ... by jrootabega on Wednesday October 06, 2021 @07:57AM (#28772012)
For every conscientious person like you, there are 100 kids, who don't even have fully formed brains, desperate to participate in this system.
Re:Twitch source code and customer data has reportedly been ... by fooey on Wednesday October 06, 2021 @12:07PM (#28774768)
Twitch has a huge problem with waves of hate bots spamming and overwhelming smaller streamers, and it's been getting worse.

They really need that verification option just to avoid getting run off the platform.

Re:Twitch source code and customer data has reportedly been ... by canada_dry on Wednesday October 06, 2021 @10:31AM (#28773623)
This is a readily solvable problem i.e. the only phone number I use/give online is a VOIP# that just redirects to voicemail immediately (and blocks the call if it's on my SPAMMER list of persistent annoyances).

For friends/family they have my cell# and it only lets calls through if they're in my contacts.

Re:Twitch source code and customer data has reportedly been ... by jrootabega on Wednesday October 06, 2021 @10:47AM (#28773801)
Even though it should not be, this approach is a luxury that can only be afforded by those who do not need to take live calls from previously-unknown numbers. Job hunters, medical patients, etc.
Re:Twitch source code and customer data has reportedly been ... by Semaphor on Wednesday October 06, 2021 @10:50AM (#28773836)
It’s readily solvable not to require a phone number to add a TOTP app.
Re:Twitch source code and customer data has reportedly been ... by sirclueless on Wednesday October 06, 2021 @02:40PM (#28776651)
The point isn't to authenticate control of an account, it's to tie the account to some kind of expensive-to-replicate real-world cost, ideally one that most potential customers are already paying for.

Phone numbers are nice because the marginal cost to a customer is low (they probably already have one) while the marginal cost to a bad actor is high (it's expensive to acquire many of them or to change one once it's been identified as malicious).

Re:Twitch source code and customer data has reportedly been ... by Semaphor on Wednesday October 06, 2021 @03:05PM (#28776951)
My current phone contract: 3.99€/month

My current twitch subscriptions: 11.97€/month

I can’t really see how they need my phone number to make it too expensive to be a bot.

And if that is the thing, then that’d makes them even more shady, claiming it’s for account security when it’s for their bit protection.

Re:Twitch source code and customer data has reportedly been ... by dhimes on Wednesday October 06, 2021 @10:40AM (#28773713)
How much does your VOIP cost?
Re:Twitch source code and customer data has reportedly been ... by canada_dry on Wednesday October 06, 2021 @10:58AM (#28773925)
I use voip.ms and is pay-as-you-go so it's nominal e.g. $1-2/mnth. It allows setting up all sorts of call handling rules (time-of-day, CID lists, call trees).
Re:Twitch source code and customer data has reportedly been ... by mariusor on Wednesday October 06, 2021 @11:13AM (#28774121)
From what I can see their 2FA is not inhouse. They're using twilio's Authy (first time I've heard of it, honestly) so maybe the phone numbers are not in the leak.
Re:Twitch source code and customer data has reportedly been ... by reilly3000 on Wednesday October 06, 2021 @11:22AM (#28774234)
I’m assuming they may have had access to private API keys so unfortunately Authy may not be immune. That is unless Authy hides those details from their customers.
Re:Twitch source code and customer data has reportedly been ... by trey-jones on Wednesday October 06, 2021 @01:34PM (#28775870)
Authy does hide those details from their customers.