T
Twitter Privacy Blog
privacy.twitter.com · Company blog · on HN since 2019
Twitter Privacy Blog is Twitter's company blog announcing security incidents, vulnerabilities and privacy issues affecting accounts.
What HN saysHN commenters cite it for breach notices, such as the 5.4 million account data leak and the anonymous accounts issue.
19HN people shared it
5linked it in comments
14stories submitted
1.1Kstory points
3 years agolast shared
2019people per year2026
Most-shared posts
- 1An incident impacting 5M accounts and private information on Twitter6 people · 810 points · first shared 2022 · 450 comments on HN
- 2An Incident Impacting your Account Identity4 people · 167 points · first shared 2020 · 2 comments on HN
- 3Twitter for Android Security Issue2 people · 10 points · first shared 2019 · 1 comments on HN
- 4An incident impacting password resets on Twitter2 people · 7 points · first shared 2022 · 1 comments on HN
- 5Twitter says no evidence that alleged sold user data exploited from its systems2 people · 6 points · first shared 2023 · discussion on HN
- 6Twitter for Android Security Vulnerability1 people · 48 points · first shared 2020 · 26 comments on HN
- 7Twitter Data Cache on Mozilla Firefox1 people · 39 points · first shared 2020 · 7 comments on HN
- 8Twitter for Android Security Issue1 people · 4 points · first shared 2019 · 1 comments on HN
What HN people wrote when they linked it
rndgermandude · 2022-08-08
Just ask twitter about it... They will tell you you're a bot unless you pony up a "real" phone number, and then they get breached and tell people: sorry you will get doxed now because we lost your data, but you shouldn't have used your real phone number[1].
[1] "If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account."
https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anony…
rvz · 2022-11-29
This breach itself is not news. [0] [1]
This part is the 'news' you are looking for:
> "In September, and now more recently, on November 24th, the 5.4 million Twitter records have now been shared for free on a hacking forum."
> "These records contain either a private email address or phone number, and public scraped data, including the account's Twitter ID, name, screen name, verified status, location, URL, description, follower count, account creation date, friends count, favorites count, statuses count, and profile image URLs."
> "We were told that it consists of over 17 million records but could not independently confirm this."
Let the SS7, phishing and SIM swapping games begin on Twitter and beyond and hiding your accounts won't help as your PII with your phone number and email is there forever.
[0] https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anony…
[1] https://news.ycombinator.com/item?id=32399949
wfme · 2023-09-16
Which security breach are you referring to? I'm not aware of any major ones that have happened since the acquisition, but this one seems to be the one people point to even though it happened prior.
https://privacy.twitter.com/en/blog/2023/update-about-an-alleged-incid…
Ladyady · 2022-08-09
Everyone rushing to check this maybe?
https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anony…
jraph · 2020-02-04
I read the article and thought, "well, yes, the option that needed to be enabled on the account for the attack to work describes what the API did, what is the bug?"
I found the original notice from twitter [1] easier to understand (maybe change the URL of this post?) and it does not speak about a bug. Twitter did implement a change so that the attack cannot be done anymore though.
I did not understand the fix itself, it seems the API cannot be used for its intended use anymore?
[1] https://privacy.twitter.com/en/blog/2020/an-incident-impacting-your-ac…