News for hackers. Stuff that matters.
Re:An incident impacting 5M accounts and private information... by some_random on Tuesday August 09, 2022 @12:45PM (#32400337)
>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account.

I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

Re:An incident impacting 5M accounts and private information... by CommanderData on Tuesday August 09, 2022 @01:24PM (#32400913)
Twitter would actively block one time numbers. This seems like a lie.

I tried to use onoff numbers with Twitter on multiple occasions but failed to receive anything. They are being very misleading here.

Re:An incident impacting 5M accounts and private information... by pigtailgirl on Tuesday August 09, 2022 @02:03PM (#32401489)
-- not only do they block one time numbers - google voice numbers - etc - they claim you CAN sign up with just an email account - let you - and then 30 minutes later automatically lock your account and tell you the only way to verify it is with a number - I was setting up an account a week ago for a client and I eventually gave up - because I was sick of being lied to by their UI --
Re:An incident impacting 5M accounts and private information... by RonMarken on Tuesday August 09, 2022 @05:14PM (#32404419)
Some people claim this is the situation with the new Twitter onion-service. Sad.
Re:An incident impacting 5M accounts and private information... by londons_explore on Tuesday August 09, 2022 @12:51PM (#32400435)
No mention of that fact that 'use another phone number' is quite an expensive thing to do in countries where a phone number has an annual fee of hundreds of dollars.

Suddenly 'use twitter securely' has gone from 'free' to 'hundreds of dollars a year'. Perhaps they should announce this as a price change instead?

Re:An incident impacting 5M accounts and private information... by RL_Quine on Tuesday August 09, 2022 @01:17PM (#32400820)
If you know the right providers it's about $2/month for a non-VOIP, physical SIM to receive SMS for this sort of garbage.
Re:An incident impacting 5M accounts and private information... by HowardStark on Tuesday August 09, 2022 @01:19PM (#32400855)
Would be super interested in hearing more about where you could find such a deal _with a physical SIM_. Seems far too good to be true.
Re:An incident impacting 5M accounts and private information... by RL_Quine on Tuesday August 09, 2022 @01:22PM (#32400898)
Many "IOT" providers give physical numbers for almost no cost, and they provide physical SIM cards for the service. The aren't VOIP so aren't blocked by twilio, etc for use with Twitter and other services.
Re:An incident impacting 5M accounts and private information... by philliphaydon on Tuesday August 09, 2022 @01:27PM (#32400953)
Any examples of providers?
Re:An incident impacting 5M accounts and private information... by danbtl on Tuesday August 09, 2022 @01:33PM (#32401054)
Hologram.io or Twilio
Re:An incident impacting 5M accounts and private information... by R0b0t1 on Tuesday August 09, 2022 @01:47PM (#32401242)
These and even much smaller providers are usually known to spammers. I've had poor luck with them.
Re:An incident impacting 5M accounts and private information... by eli on Tuesday August 09, 2022 @02:03PM (#32401488)
You can sign up for a Twitter account with a Twilio number? I'd be surprised
Re:An incident impacting 5M accounts and private information... by patch_cable on Tuesday August 09, 2022 @03:19PM (#32402728)
I used Red Pocket, which comes down to about 2.50/month if you buy a prepaid card on eBay: https://www.redpocket.com/plans/annual
Re:An incident impacting 5M accounts and private information... by R0b0t1 on Tuesday August 09, 2022 @01:45PM (#32401206)
These phone number blocks have usually been utilized by spammers in the past. A lot of them don't work.
Re:An incident impacting 5M accounts and private information... by RonMarken on Tuesday August 09, 2022 @02:38PM (#32402057)
Anyone accept Monero?
Re:An incident impacting 5M accounts and private information... by colechristensen on Tuesday August 09, 2022 @12:55PM (#32400485)
>countries where a phone number has an annual fee of hundreds of dollars.

Is this a thing? I've never heard of it. Where?

Re:An incident impacting 5M accounts and private information... by AlotOfReading on Tuesday August 09, 2022 @01:06PM (#32400657)
You need a plan to have a number because it's difficult/impossible to get a number allocated to you as an individual. If we assume "hundreds" means >=$200/year, then the maximum monthly payment we can have for that not to be true is $16/mo. The absolute cheapest phone plans I could find in the US that weren't for alarm systems were $15/mo on mvnos like mint. In practice, I suspect few people are paying less than $25-$30 a month, or "hundreds" a year for their numbers.
Re:An incident impacting 5M accounts and private information... by trasz on Tuesday August 09, 2022 @01:20PM (#32400865)
There are no prepaids? Which country do you have in mind?
Re:An incident impacting 5M accounts and private information... by thaumasiotes on Tuesday August 09, 2022 @01:35PM (#32401074)
Prepaid phone plans in the USA charge you a monthly rate just like subscription plans do. They may also charge you for usage, though that appears to have fallen off compared to the past.

Some years ago I looked into prepaid pricing and determined that it was significantly more expensive than a subscription plan at even my almost-never-use-it levels of phone use. (At that time, pricing was based on (1) a reasonable per-use rate, which would have been very cheap; combined with (2) a high flat fee charged on any day you used any feature of the plan, which already nullified any price advantage; and (3) a requirement to add funding to the plan every month, regardless of whether you had an existing balance.)

Re:An incident impacting 5M accounts and private information... by Macha on Tuesday August 09, 2022 @02:19PM (#32401738)
Wow, the prepaid plans in your country suck.

How they work here is:

1. You need to top up by €20 at least once a year to keep your account

2. You may sign up to an offer, which will deduct a portion of a top up each month to activate the offer (e.g top up by > €20, the phone company takes €10 for unlimited texts, or €20 for unlimited data).

3. If you don't top up as required by your offer, you fall back to a state as if you had no offer

4. If you have no offer there's fixed fees of like 20c/sms and €0.50/min of calls, €2/day for 100mb of data

Re:An incident impacting 5M accounts and private information... by terinjokes on Tuesday August 09, 2022 @08:07PM (#32406330)
We used to have pre-paid plans like that in the US, but they've fallen out of favor in the last 10-15 years. They were complicated to use, and very expensive: many MVNOs had rules such has having at least one top-up a month to keep the line active, and money used to top-up had time limits before they'd expire.

Now pre-paid is often just paying for a month before usage rather than after usage. Even cheaper providers like Mint sign you up for 3 months at once, which can get expensive if all you want it for is just satisfying Twitter.

Re:An incident impacting 5M accounts and private information... by jlarocco on Tuesday August 09, 2022 @01:52PM (#32401325)
At some point it just gets ludicrous, though.

Is it reasonable for everybody to go buy "burner" phones to sign up for Twitter?

The truth is, it's stupid for Twitter to require a phone number, and it's especially stupid that they blame the user for using their real number.

Re:An incident impacting 5M accounts and private information... by londons_explore on Tuesday August 09, 2022 @12:59PM (#32400552)
It's true in the USA if you stick to the big providers... Ring up t-mobile and say 'I'd like a line with 0 minutes and 0 GB of data, just to receive verification texts for Twitter' and they'll probably quote you $200 a year or so...
Re:An incident impacting 5M accounts and private information... by jrockway on Tuesday August 09, 2022 @02:10PM (#32401591)
Tracphone is the company you want for this sort of thing. A SIM costs $0.99 (requires unlocked phone of course) and you add $15 to the account to get 500 texts. (I think you can do this with cash at a place like Walmart.)

It is expensive if you need to keep the plan around, but Twitter doesn't seem to regularly send SMSes to the phone number, so you probably don't need to pay beyond the first month.

Re:An incident impacting 5M accounts and private information... by fuckstick on Tuesday August 09, 2022 @01:48PM (#32401264)
Why the arbitrary limitation to the “big providers” - you can get a basic Tello plan with SIM for $5/month prepaid - and they’re a T-mobile MVNO so it’s a T-Mobile number.
Re:An incident impacting 5M accounts and private information... by colechristensen on Tuesday August 09, 2022 @01:08PM (#32400685)
$120 before tax for T-mobile for 1000 minutes, 1 GB/mo.
Re:An incident impacting 5M accounts and private information... by davchana on Tuesday August 09, 2022 @01:14PM (#32400785)
In India, its not expensive at all, but every sim card is available only after you provide a copy of your national id card aka Aadhar Card.
Re:An incident impacting 5M accounts and private information... by yunohn on Tuesday August 09, 2022 @01:21PM (#32400888)
But as the OP mentioned, you need to maintain a paid plan and activity on the SIM to keep your number from expiring. It’s neither indefinite nor free.
Re:An incident impacting 5M accounts and private information... by davchana on Tuesday August 09, 2022 @03:07PM (#32402521)
Yes, I meant that even if somebody who wants to keep the identity unattached to twitter (& thus not risk doxxing after twitter data leak), in India its not possible at all even if they have money to afford.
Re:An incident impacting 5M accounts and private information... by thaumasiotes on Tuesday August 09, 2022 @01:36PM (#32401092)
> but every sim card is available only after you provide a copy of your national id card aka Aadhar Card.

Can you not get an activated SIM off the street?

Re:An incident impacting 5M accounts and private information... by davchana on Tuesday August 09, 2022 @03:06PM (#32402494)
No, technically every SIM gets activated only when mobile phone provider gets the user's documents copy & a verification call comes from mobile company's service center to an existing number of yours or family (& you verify your documents details). If you don't have a existing number to reach, they make you to bring documents to official store. There is no pre activated SIM cards.

Mostly, like any other country, this happened because they found bad people were using pre activated sim cards for terrorism.

My exiting phone number is now 14 years old, same provider, prepaid. I have been required to submit updated KYC about 4 times in these years.

Re:An incident impacting 5M accounts and private information... by drvsh on Tuesday August 09, 2022 @01:43PM (#32401188)
No
Re:An incident impacting 5M accounts and private information... by traceroute66 on Tuesday August 09, 2022 @12:59PM (#32400564)
> I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

I had some old accounts that did not require a phone number.

At least until I wanted to enable TOTP 2FA.

At which point the numnuts at Twitter would not just let me "just" enable TOTP, I was forced to provide a phone number (which, to add insult to injury, for at long time they refused to accept because they would only send messages to a limited number of carriers).

Re:An incident impacting 5M accounts and private information... by gojomo on Tuesday August 09, 2022 @02:10PM (#32401598)
And then Twitter misused authentication phone numbers for marketing: https://www.ftc.gov/business-guidance/blog/2022/05/twitter-p...

And also used a sketchy service provider who was selling personal info about Twitter users to governments: https://9to5mac.com/2022/02/09/twitter-2fa-text-privacy/

Twitter has been habitually careless with user info & user privacy.

Re:An incident impacting 5M accounts and private information... by MoebiusStrip on Tuesday August 09, 2022 @02:37PM (#32402044)
Twitter decides when to hit you with the demand for a phone number. Try sh!itposting for a couple weeks. That usually does the trick.

This may be Twitter's best anti-bot measure, although state-sponsored troll farms will likely be able to afford all the SIM cards they want and need.

Re:An incident impacting 5M accounts and private information... by kordlessagain on Tuesday August 09, 2022 @12:48PM (#32400381)
The company entity requires blaming others. It can't blame itself, otherwise stakeholder value is affected. If you want to blame anyone, blame the environment that allows these types of actions by companies, or simply stop using them.

BTW, no Twitter account is "ours". If it was, we could download everything (friends and all) and move it somewhere else. Twitter needs to take ownership of all data on their platform - user accounts included. Trying to separate them into different entities is ridiculous.

Re:An incident impacting 5M accounts and private information... by 6stringmerc on Tuesday August 09, 2022 @01:25PM (#32400934)
These are cogent points and I completely agree not admitting fault seems the playbook for publicly traded companies.

It’s unfolding in real-time with Tyler Technologies and we’ll have to see how it plays out. Intelligent institutional investors are poring money into a company that is responsible for leaking millions of intended to be confidential CRIMINAL RECORDS and is trying to blame JudyRecords for finding their mistake.

Again it goes to show we don’t really own anything that turns digital, and no safeguards are guaranteed. The only recourse is legal action, which is, IMHO going to bankrupt Tyler r force numerous spin offs to pay the class action results from the CA State Bar…and potentially hundreds more.[0]

The environment is one of no consequences when hiding behind a corporate banner, for most intents and purposes. Choose who you work for wisely.

[0] www.JudyRecords.com

Re:An incident impacting 5M accounts and private information... by vladtheimpala on Tuesday August 09, 2022 @04:27PM (#32403802)
> It can't blame itself, otherwise stakeholder value is affected.

One would think dishonestly blaming others for the consequences of their own conduct would also affect stakeholder value.

Re:An incident impacting 5M accounts and private information... by strulovich on Tuesday August 09, 2022 @12:55PM (#32400486)
It might have some PR speak sprinkled, but it’s genuinely good advice, put more bluntly:

“We can screw up, if it’s important enough for you to stay anonymous you should get a separate phone number and email”

That is a good tip with every company. If you want better security, have less trust in the services you’re using.

This goes to what victim blaming is. Yes. It would be great if the victim lived in a better world. But sometimes extra caution could help them now without waiting for the entire world to change.

Re:An incident impacting 5M accounts and private information... by sneak on Tuesday August 09, 2022 @12:58PM (#32400546)
In Germany and other countries you have to show government ID to get a GSM number. Phone numbers are like bank accounts: strongly linked to official name and identity.

This advice is bullshit.

Re:An incident impacting 5M accounts and private information... by croes on Tuesday August 09, 2022 @01:11PM (#32400731)
But you can abandon a number after you registered on Twitter. Doesn't help against agencies but against scrappers
Re:An incident impacting 5M accounts and private information... by lynndotpy on Tuesday August 09, 2022 @01:29PM (#32400979)
My very recent experience contradicts this. I removed my number and was immediately locked out until I added it back.
Re:An incident impacting 5M accounts and private information... by jrockway on Tuesday August 09, 2022 @02:11PM (#32401612)
I don't think you tell Twitter that you canceled your cell phone contract. They don't need to know.
Re:An incident impacting 5M accounts and private information... by soperj on Tuesday August 09, 2022 @03:47PM (#32403235)
They mean you can get a different phone number, not remove it from twitter.
Re:An incident impacting 5M accounts and private information... by lynndotpy on Wednesday August 10, 2022 @08:27AM (#32410773)
Ah, I misunderstood that comment entirely. This makes more sense
Re:An incident impacting 5M accounts and private information... by vlovich123 on Tuesday August 09, 2022 @01:27PM (#32400963)
Doesn't that make account takeovers easy?
Re:An incident impacting 5M accounts and private information... by croes on Wednesday August 10, 2022 @06:49AM (#32410001)
My social media accounts are all disposable, so it doesn't really matter to me.
Re:An incident impacting 5M accounts and private information... by vlovich123 on Thursday August 11, 2022 @01:59PM (#32429497)
Sure. You understand how that's not necessarily the case for many other people, right?
Re:An incident impacting 5M accounts and private information... by voxl on Tuesday August 09, 2022 @01:32PM (#32401039)
There is an exceptional difference you left out. In criminal situations, the criminal is punished, there is a deterrent. What is the deterrent here? Without a deterrent, there is a moral failure.
Re:An incident impacting 5M accounts and private information... by JacobThreeThree on Tuesday August 09, 2022 @12:51PM (#32400430)
Yeah, it's shocking they would say this when they do require phone numbers in many instances.
Re:An incident impacting 5M accounts and private information... by anjel on Tuesday August 09, 2022 @01:05PM (#32400636)
Many unexplained instances. (Twitter will claim a prior but unspecified TOS violation but thats a dodge, rather than a justification)
Re:An incident impacting 5M accounts and private information... by echelon on Tuesday August 09, 2022 @01:53PM (#32401343)
Fucking vile victim blaming.

Twitter should not be requiring phone numbers, especially when they don't care enough to protect them.

This is why we should get back to protocols for communication instead of platforms.

Re:An incident impacting 5M accounts and private information... by yodsanklai on Tuesday August 09, 2022 @01:36PM (#32401079)
> If you operate a pseudonymous Twitter account

If you operate a pseudonymous account anywhere, you should always assume there's a slight possibility that one day your identity is known.

I think it's not far stretched to think that in the future, malevolent governments will have access to whatever things we may have posted and use it against us.

Re:An incident impacting 5M accounts and private information... by bena on Tuesday August 09, 2022 @01:35PM (#32401077)
I mean, originally twitter was an SMS based service. It was made for phones.
Re:An incident impacting 5M accounts and private information... by aendruk on Tuesday August 09, 2022 @03:17PM (#32402704)
Yep, Twitter got my phone number because at the time 40404 was the only mobile interface, and half the point of the service.
Re:An incident impacting 5M accounts and private information... by spullara on Tuesday August 09, 2022 @01:31PM (#32401017)
You can remove your phone number after creating the account.
Re:An incident impacting 5M accounts and private information... by rozap on Tuesday August 09, 2022 @01:48PM (#32401258)
I really doubt it's a hard delete.
Re:An incident impacting 5M accounts and private information... by pauldenton on Tuesday August 09, 2022 @03:23PM (#32402811)
And right after you do your account will be locked
Re:An incident impacting 5M accounts and private information... by spullara on Tuesday August 09, 2022 @03:29PM (#32402923)
I have an account with no email address and no phone number so not sure what you mean.
Re:An incident impacting 5M accounts and private information... by iszomer on Tuesday August 09, 2022 @01:45PM (#32401217)
I have yet to add my phone number to my account. My guess is that it isn't applicable for legacy accounts circa 2008.
Re:An incident impacting 5M accounts and private information... by gojomo on Tuesday August 09, 2022 @02:17PM (#32401689)
It can be triggered for opaque reasons. My account dates to February 2007. I was prompted for a phone number a few years and given no other options to recover the account. Burner & VOIP numbers that work for many other things, including SMS verifications, were rejected.

I suspect the reason was some rapid changes in my IP address in a short period, together with a lot of Twitter tabs open – whose constant background requests often seem to trigger, for me, some sort of Twitter-side connection-slowing. (Their own shoddy, high-weight design makes my normal usage pattern look like a DoS attack to them.)

So your style of usage, moreso than your account age, is likely for being spared their arbitrary phone-number inquisition.

Re:An incident impacting 5M accounts and private information... by tnzk on Tuesday August 09, 2022 @01:31PM (#32401003)
> a publicly known phone number or email address

I don't get the definition of "publicly" here. Does it mean something on Internet, or include numbers I tell people in-person? If the former, not so many people put their number online I suppose...

Re:An incident impacting 5M accounts and private information... by devmunchies on Tuesday August 09, 2022 @01:29PM (#32400985)
> you're forced to add a phone number to use twitter.

is that true for the desktop web client?

Re:An incident impacting 5M accounts and private information... by gpm on Tuesday August 09, 2022 @01:30PM (#32400998)
It was for me.

When I created an account, they blocked it 30 seconds later (before I had done literally anything) and would only unblock it upon me adding a phone number. Google suggested that this was common practice by them at the time.

Re:An incident impacting 5M accounts and private information... by madars on Tuesday August 09, 2022 @01:32PM (#32401035)
Yes. They will let you sign up with just an email but after few minutes of activity your account will be locked and they will demand phone number verification.
Re:An incident impacting 5M accounts and private information... by skybrian on Tuesday August 09, 2022 @01:28PM (#32400969)
They seem to be recommending that you use an unlisted phone number. That seems like a good idea.
Re:An incident impacting 5M accounts and private information... by gojomo on Tuesday August 09, 2022 @02:17PM (#32401710)
To some privacy threats, essentially no numbers are "unlisted".
Re:An incident impacting 5M accounts and private information... by 627467 on Tuesday August 09, 2022 @01:00PM (#32400576)
Agreed but, in what jurisdiction does Twitter require phone numbers?
Re:An incident impacting 5M accounts and private information... by RL_Quine on Tuesday August 09, 2022 @01:24PM (#32400915)
All of them. You don't need to provide one on sign up, but your account will be soft banned typically in a couple of hours until you provide one. So it's a requirement that they aren't forthcoming about.
Re:An incident impacting 5M accounts and private information... by lostlogin on Tuesday August 09, 2022 @01:52PM (#32401331)
I have an account that doesn’t have one and works fine. I wonder why they don’t always require it.
Re:An incident impacting 5M accounts and private information... by kevinh on Tuesday August 09, 2022 @01:26PM (#32400935)
A year or so ago, I created an account and followed ten or so people (no tweets at that time). When I went to log in the next day, it wouldn't let me log in until I attached a phone number. As I understand it, that was a relatively common occurrence.
Re:An incident impacting 5M accounts and private information... by gojomo on Tuesday August 09, 2022 @02:27PM (#32401860)
And, this is just one of many examples of a deep, deep dishonesty at the core of Twitter Inc's operations:

Pretending they're not requiring something when in practice, a giant proportion of their userbase faces it.

Pretending anything changes when you click 'See This Less Often' on some annoying feature.

Constantly undoing a user's preference for 'Latest' over algorithmic 'Home'.

Claiming they don't "soft-ban" but absolutely, verifiably, hiding some users' content from others who have explicitly followed them.

Implying there's some effective "appeal" process for arbitrary & often clearly erroneous moderations decisions – when instead it's just designed for coercing compliance, including the simualted "voluntary" deletion of tweets, under penalty of losing your account indefinitely.

Slurring & hiding replies with no hint of offense as "potentially offensive".

Describing tweets as "unavailable" when (often) all you have to do is click to see it - wasting users time.

Offering "Show additional replies" even when there's nothing more to show – again wasting users' time.

Re:An incident impacting 5M accounts and private information... by franklampard on Tuesday August 09, 2022 @02:11PM (#32401619)
> add a phone number

They do this to combat spammers, don’t they?

Re:An incident impacting 5M accounts and private information... by rex_lupi on Tuesday August 09, 2022 @01:27PM (#32400954)
Tip: If you email(anonymously ofc) twitter support that you do not have a phone number to receive the OTP for verification during account creation, they generally approve your request.
Re:An incident impacting 5M accounts and private information... by mhh__ on Tuesday August 09, 2022 @01:27PM (#32400964)
My twitter account does not have a phone number attached