Hacker News Reader

Comment by janwillemb | Hacker News Reader

We're talking about a security issue here, not regular support

It's not really a "security issue" in the way we think of them. This is just an -- optional -- security feature that isn't working, and as it turns out, not working on just one person's account. The OP shows that Twitter Security actually did investigate reasonably promptly, and replied that they couldn't repro the issue.

And I think that's not unreasonable. The security team is mainly about triaging security vulnerabilities. They likely aren't equipped to deal with an issue that appears to be restricted to a single account, that's related to an optional feature.

Now, Twitter's main-line support seems to be worse than useless, but I suppose that's to be expected, sadly.

So the feature is explicitly for security? Security feature.

It is security for the user, not for the server. It is still security.

I'm not saying it's the right way to do things, just that it's not unreasonable. Corporate infosec teams just usually aren't staffed to deal with this sort of issue. At best they can pass the user to regular support, or pass the issue on to whatever engineering team is responsible for third-party 2FA. And that's where the issue lies: if Twitter's regular support wasn't completely useless, we wouldn't have this problem here.

> and as it turns out, not working on just one person's account.

It's actually three. Three accounts, on three different browsers (Chromium, Firefox, Safari), using three different operating systems (Ubuntu, Windows, macOS). I was able to replicate it exactly as I've described every single time. They claim that they haven't. I'm in no position to try it with a larger number of accounts.

And that's basically the worst thing to happen in any bug report scenario: unable to reproduce. Obviously we all want our support issues to get resolved in a positive manner, but sometimes it's not possible. And it's not like we're paying for Twitter, so they have no obligation to help us beyond what they think might make their actual paying customers unhappy. You may disagree with their math on this one, but it's their math to make.

Reply on news.ycombinator.com