Re:Twilio incident: What Signal users need to know
by sgc on Monday August 15, 2022 @06:54PM
(#32476587)
At least number of requests + number of open unverified and unexpired requests. So you need to guess average length of time to verify and the abandon rate.
It also seems like there is also a buffer period when the numbers are registered and not yet purged from the twilio system:
> 1) their phone numbers were potentially revealed as being registered to a Signal account, or 2) the SMS verification code used to register with Signal was revealed.
We don't know how often Signal purges that, so, although unlikely, it could be a day or a week or more of registrations.
It also seems like there is also a buffer period when the numbers are registered and not yet purged from the twilio system:
> 1) their phone numbers were potentially revealed as being registered to a Signal account, or 2) the SMS verification code used to register with Signal was revealed.
We don't know how often Signal purges that, so, although unlikely, it could be a day or a week or more of registrations.