69 votes
Accepted

Does this mean Target's twitter was successfully attacked?

Yes, Target did have their account hacked. In fact, quite a lot of verified account holders have been hacked to further this scam. The scammers do this to impersonate other accounts, including Elon ...
forest's user avatar
  • 66.7k
30 votes

Does this mean Target's twitter was successfully attacked?

Target has since confirmed my suspicion: Hard Fork article “Early this morning, Target’s Twitter account was inappropriately accessed” a company spokesperson told Hard Fork in an email. “The access ...
Oddthinking's user avatar
  • 1,859
9 votes
Accepted

SSL certificate issued in my company's name instead of twitter.com

If for some or all SSL sites you're seeing the certificates as being issued by your employer, it's likely that they are using an SSL intercepting proxy (e.g. BlueCoat). These systems are designed to ...
Rory McCune's user avatar
  • 62.3k
6 votes

Why don't Twitter and Facebook enforce password complexity during sign up?

Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app ...
securityOrange's user avatar
6 votes
Accepted

How can someone hack Twitter accounts so fast?

First, don't assume that it was just one "hacker". Anonymous is a pretty large group, and they could have coordinated the activity. For all we know, the Anonymous user that tweeted about the hacked ...
A. Darwin's user avatar
  • 3,582
5 votes
Accepted

Can my oppressive government trace my Twitter activity and detect me?

While the communication between your browser and Twitter is encrypted with HTTPS and also additionally in case of Shadowsocks, the messages you publish can be seen by others - that's the point of ...
Steffen Ullrich's user avatar
4 votes

Can my oppressive government trace my Twitter activity and detect me?

Steffen's answer is about how the activity of posting on twitter could be detected. Mine is how to change hints that something is suspect into evidences that a specific human being has posted messages....
Serge Ballesta's user avatar
3 votes

How to store user credentials in a web application?

As described on Twitter's API OAuth doc, the user's Twitter credentials should not be needed. In other words, when you first connect your user to their Twitter account you should launch a Twitter ...
Forest J. Handford's user avatar
2 votes

Twitter allows the password to be resolved from a stolen cookie. Is that a problem?

Their response is perfectly valid. They are saying that what you found is the intended behavior. There is a usability trade off with security features and they are saying they aren't going to ...
joe's user avatar
  • 592
2 votes

How to store user credentials in a web application?

If I understood you correctly you want each user to have multiple Twitter accounts. In that case you don't need to store user credentials, you just need to store multiple OAuth2 tokens for every user
Mr. E's user avatar
  • 1,964
2 votes

Can you still be tracked when using a VPN?

Short answer- yes. Tracked by who? Some 16 year-old who wants to troll you? Then I doubt it. Government? Yes. VPN's (most) keep records of all your traffic (even though many claim they don't, laws in ...
NULL.Dude's user avatar
  • 201
2 votes

How did the Tweetdeck XSS vulnerability work?

This attack worked for a very simple reason - TweetDeck did not sanitize the user input at all under some circumstances. The attacker did not discovered a clever way to fool the XSS filter. Instead he ...
Anders's user avatar
  • 65.6k
2 votes
Accepted

Twitter switching to 'mobile.twitter.com' after it detected the browser is outdated

Regarding #1: Desktop-oriented sites often use newer and more demanding features than their mobile counterparts. It is likely that your browser does not support some functionality that the regular ...
DoubleD's user avatar
  • 3,942
2 votes
Accepted

Does delaying downloading a Twitter archive "protect your account"?

Time delays certainly can add security, since attackers usually have a narrow window in which to launch an attack before it is noticed (and the target can narrow this window by notifying the potential ...
CBHacking's user avatar
  • 48.4k
2 votes

Could there be malware in a video on twitter?

While a video file could have been "crafted to exploit a vulnerability in the codec or media player" (from an answer of Polynomial), the video upload features on social media sites typically ...
Esa Jokinen's user avatar
  • 18.9k
2 votes
Accepted

How can Twitter and other platforms prevent third party clients from using their API?

The first step would be to require all clients to have their own API key and make clients illegal which try to "mimic" the original client by exactly replicating the behavior in order to ...
Steffen Ullrich's user avatar
1 vote
Accepted

interchangeable IDs for login under PCI DSS like Facebook and Twitter

There's nothing in PCI DSS that prevents you allowing users to login with multiple IDs (such as their email address or their phone number) - just make sure that you apply the same security controls ...
Gh0stFish's user avatar
  • 10.9k
1 vote

Can't log in into Twitter for Android app after SSL Bypass

Ok so it turns out everything worked fine I just got IP blocked. Turned on a VPN and there are no issues.
bvr's user avatar
  • 21
1 vote

How does Google Authenticator interact with apps on an iPhone?

For example, if someone somehow finds my Twitter password and installs the Twitter app on their smartphone wouldn't they get instantaneous access to my Twitter account? So how exactly does Google ...
vidarlo's user avatar
  • 16.1k
1 vote

Is it secure: unsecured Wi-Fi + social network authentication to access the web?

One of the points of social media login is to avoid password entry by resuing your existing loggged-in state with the social media. If you have not already logged in to the social media site in your ...
billc.cn's user avatar
  • 3,926
1 vote

Does allowing Facebook cookies over Tor threaten my anonymity?

If you've always used that Facebook account through Tor, and never through your normal connection, and the Facebook account is for an anonymous identity rather than your real identity and you never ...
Lie Ryan's user avatar
  • 31.4k
1 vote

External JS Security

Check https://www.owasp.org cheatsheet about that https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html About CPS if you want to get shortversion about it ...
fearis's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible