Twilio incident: What Signal users need to know

Re:Twilio incident: What Signal users need to know by g_sch on Monday August 15, 2022 @04:46PM (#32475138)

My reading of the post is that they determined the "1,900 users" figure by the number of users who had requested a code during the duration of the Twilio incident, as the attacker could have accessed their SMS messages at any point during the compromise:

> During the window when an attacker had access to Twilio’s customer support systems it was possible for them to attempt to register the phone numbers they accessed to another device using the SMS verification code. The attacker no longer has this access, and the attack has been shut down by Twilio.

[ Parent | on HN ]

Re:Twilio incident: What Signal users need to know by sgc on Monday August 15, 2022 @06:54PM (#32476587)

At least number of requests + number of open unverified and unexpired requests. So you need to guess average length of time to verify and the abandon rate.

It also seems like there is also a buffer period when the numbers are registered and not yet purged from the twilio system:

> 1) their phone numbers were potentially revealed as being registered to a Signal account, or 2) the SMS verification code used to register with Signal was revealed.

We don't know how often Signal purges that, so, although unlikely, it could be a day or a week or more of registrations.

[ Parent | on HN ]