Hot answers tagged

69

Yes, Target did have their account hacked. In fact, quite a lot of verified account holders have been hacked to further this scam. The scammers do this to impersonate other accounts, including Elon Musk's, by changing their name while retaining their verified status. In this case, it just looks like the scammer is using Target's account directly. This scam ...


31

Target has since confirmed my suspicion: Hard Fork article “Early this morning, Target’s Twitter account was inappropriately accessed” a company spokesperson told Hard Fork in an email. “The access lasted for approximately half an hour and one fake tweet was posted during that time about a Bitcoin scam.” “We’re in close contact with Twitter, have ...


17

It's not about your anonymity, but about your audience. As @darkf mentioned, Twitter doesn't have the same level of privacy settings that Facebook does. A user's tweets are either all protected or all public. This means that you have less control over your audience. A message that you meant as a sarcastic comment could be retweeted (repeated with attribution)...


12

Using a VPN in and of itself isn't going to stop people who want to trace specific activities on-line. A VPN encrypts the traffic from your machine to the exit point of the VPN network. So what it protects you from is someone trying to look at your network traffic if they sit between you and your VPN provider (for example a correctly set-up VPN should ...


9

If for some or all SSL sites you're seeing the certificates as being issued by your employer, it's likely that they are using an SSL intercepting proxy (e.g. BlueCoat). These systems are designed to allow the company to inspect traffic going over their Internet connection even when it is SSL encrypted. This can be done for purposes of malware scanning and/...


9

People can still trace you with other methods. Just because your IP is different and your traffic is encrypted in a tunnel doesn't mean you can't be tracked. There are other ways people can track you. For example: they can find who you are by doxing your IP isn't the only thing that identifies you on the internet your VPN service can see your IP and what ...


7

Rather than logging in to accounts they control, I expect voter fraud would be done by clickjacking or CSRF, harnessing the social viral power of Facebook to attract unwitting accomplices. With the prevalence lately of images on Facebook that claim that you can obtain a PS4 simply by "liking" and "sharing" an image and the sheer numbers of people who do so, ...


6

Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app you're building might be not to follow Facebook and Twitter's examples in terms of security. For resources, I recommend looking to OWASP first. If you're not ...


6

First, don't assume that it was just one "hacker". Anonymous is a pretty large group, and they could have coordinated the activity. For all we know, the Anonymous user that tweeted about the hacked accounts could be a spokeperson, rather than a "hacker". Second, the attackers reportedly hacked into dozens of accounts and, although we cannot know for ...


6

This has more to do with risk management. You do not have any contract with Facebook or Twitter. So you have a risk that they may change the contents of the JavaScript file without you knowing. This can be malicious or accidental, either way you have no control of this risk. So unless you get a contract with the external party which moves the liability to ...


6

This is not a feature in Twitter or the Chrome version you're using. It's either a bug in the browser or a misconfiguration on your side. Please refrain from using non-standard and non-official browsers. Instead of using SRWare Iron (a fork of Chromium), you should use Chrome, which can be easily configured to reach your privacy goals.


6

There is absolutely nothing in the OpenID/OAuth authentication methods that guarantees an individual signing-in through them is indeed a unique user. OpenID provides a bit more data in a form of a certificate (user name, email address, and notary) than OAuth's valet key authentication, but that alone isn't enough to prevent voting fraud. Using the word fraud ...


6

I'm the maintainer of HTTPS Everywhere and just merged a pull request fixing this issue. It should be in the next release (out in 1-2 weeks). For future reference, submitting these to Github means they'll get fixed sooner :). (https://github.com/efforg/https-everywhere)


4

I found an HTTPs Everywhere bug report explaining why this happens: This appears to be an Chrome API bug. We're getting the onCookieChanged event, and the cookie we get in that event has a storeId of 0 regardless of where it comes from (Incognito or not). We then turn right around and set the secure flag on the cookie and issue a cookies.set(cookie). ...


3

I do not know of a way to retrieve who did this short of asking Twitter. As to prevention, demanding on availability you could tell your friend to enable 2 factor authentication This will make any login attempt more noticeable due to getting a sms. More about security on Twitter you can find on Twitter Security Center We can only guess what happened ...


3

As described on Twitter's API OAuth doc, the user's Twitter credentials should not be needed. In other words, when you first connect your user to their Twitter account you should launch a Twitter page that grants your application access to their Twitter information. If the user is not already signed onto Twitter, through the Twitter page, they will enter ...


3

bonsaivikings answer does make sense for Twitter and Facebook, but Reddit doesn't really fit in there. It's not just about the audience - it's about how the audience perceives you. Anonymity has great influence on the general behavior of the whole community, which affects that perception. Users on Reddit are mostly anonymous and almost every post is public ...


3

Using an offshore VPN can help you to hide your real identity. Every site you visit will see the IP of the VPN-Server instead of your real IP. On most VPN-Services, your IP isn't dedicated to a single user, which make it harder to identify a special customer. But this is more related to the sites you're using, because the owner of the site can see and ...


2

One provides the identity, the other provides authentication. Generally, the idea is that the identity can be given out to clients of the third party, but the secret is used for communication between the third party and the server. The access token allows them to know which account it is associated with. It's not really any different from having a ...


2

Only Twitter have the right to track their users. Simply contact Twitter and try to convince them, I pretty sure your request will get rejected. The right way to achieve what you want is by contacting the authorities in your country and file a complain of Cyberstalking


2

Twitter is publicly visible. On Facebook, your posts can be seen only by whomever you've set in your privacy settings. As for Reddit, I can only suggest anecdotally that more people talk about their real life, and add real life acquaintances, on Twitter. Reddit is a bit more detached.


2

Their response is perfectly valid. They are saying that what you found is the intended behavior. There is a usability trade off with security features and they are saying they aren't going to implement one here because the chances of a cookie being stolen is unlikely because of protections they have in place. They point out that the attacker has to have ...


2

If I understood you correctly you want each user to have multiple Twitter accounts. In that case you don't need to store user credentials, you just need to store multiple OAuth2 tokens for every user


2

Twitter seems to have a complicated history with Tor's users. The linked article seems to doubt of Twitter explaining they do not put any specific restriction against Tor's IP: Twitter does not block or force Tor users to phone verify in order to sign up. Occasionally, signups and logins may be asked to phone verify as they may exhibit behavior ...


2

Regarding #1: Desktop-oriented sites often use newer and more demanding features than their mobile counterparts. It is likely that your browser does not support some functionality that the regular site requires (or that its implementation of that functionality is non-compliant with standards, which would cause the site to render improperly). You should ...


1

One of the points of social media login is to avoid password entry by resuing your existing loggged-in state with the social media. If you have not already logged in to the social media site in your browser, simply do that over mobile connection and then connect to this wifi. Some social media may want to verify your password before you can approve an ...


1

If you've always used that Facebook account through Tor, and never through your normal connection, and the Facebook account is for an anonymous identity rather than your real identity and you never make any references using your real identity to your alter ego and vice versa, and you never login, then using Facebook over Tor does not necessarily compromise ...


1

As you said, the main threats on Facebook are the ads and malicious links/files users can share between each other. In terms of Ads, you can use an ad-blocker such as uBlock Origin or AdBlock, which as the name suggest will remove any side-bar ads. In terms of not clicking malicious/suspicious links, well, that's down to the user, as long as they are well ...


1

Check https://www.owasp.org cheatsheet about that https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html About CPS if you want to get shortversion about it check MDN https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/base-uri I personally recommend CPS for 3rd party as a must. ...


Only top voted, non community-wiki answers of a minimum length are eligible