Hacker News Reader

Comment by ganoushoreilly | Hacker News Reader

There's no evidence in this story, I'd take it with a grain of salt.

I had some doubts about veracity and while still in two minds but https://www.vn.nl/trump-twitter-hacked-again/ provides enough details that if it does turn out to be bs then they are easy enough to prove or refute - " After logging in, he emailed US-CERT". But I agree with your sense of hesitancy since the sources of the story mostly originate from Yahoo News, a Dutch marketing company called DPG Media, TechCrunch rather than the usual broader sources.

It will be interesting to see how Victor Gevers responds.

The TechCrunch article has a screenshot from the profile editor: https://techcrunch.com/wp-content/uploads/2020/10/trump-acce...

It's trivial to change with developer tools, doesn't count as evidence.

Which doesn't show the Twitter handle. Anyone can fake this by changing an accounts name, profile picture, bio, and banner.

They can, but reading about Gevers shows a track record. It’s worth being skeptical, but keep his record in mind. Apply the same skepticism to Twitter too, they haven’t got a great record.

Which is trivial to fake by going to your own profile and using your browser's inspector to swap out a few images and change a few text boxes.

I kind of think it's a toss-up if this is true. I can believe Trump would use a very weak password and not apply 2fa, but I'm very surprised that Twitter's additional guard-rails for important accounts didn't prevent this.

This is the only screenshot that the researcher posts as 'evidence' of gaining access to Trump's account. I'm afraid that this one can be easily faked with browser tools. The fact that White house officials have extra security measures on their accounts it is this only screenshot that makes it less convincing that this is true, unless the researcher publishes multiple screenshots or video evidence of logging into the account themselves.

Otherwise it can be easily dismissed as a fake screenshot, even if he 'did it' in the past.

This security researcher uses the Grammarly extension?

The guy has apparently done it before. Edit: dutch media are reporting that they have seen evidence that backs up his claim.

Done what?

He's logged into Trumps account before. His password was 'yourefired' at the time.

The source article is linked to on the story, and it says screenshots were taken. My parsing interprets it as saying that they showed these screenshots to security researchers. “screenshots were shared with de Volkskrant by the monthly opinion magazine Vrij Nederland. Dutch security experts find Gevers’ claim credible.”

https://www.volkskrant.nl/nieuws-achtergrond/dutch-ethical-h...

Also, the guy has a history (well, both do). Gevers has got into numerous other accounts before, and uncovered some disturbing stuff - tracking of Chinese Muslims via facial recognition stuff in China for example.

If you follow the references they provide, you'll see that the person responsible is a respected security researcher with a history of similar discoveries. He also posted screenshots, and suggests that he was responsible for Trump's recent tweet praising a satirical Babylon Bee article.

https://www.vn.nl/trump-twitter-hacked-again/:

Gevers comes up with a plan to make sure that this time the White House responds. He refuses to say what he did exactly, but in a tweet that has now been removed, he alludes to the fact that he was the one to post the Babylon Bee tweet in Trump’s name. Shortly after, he posted a tweet in his own name, tagging Trump and Team Trump, saying the Babylon Bee-tweet could now be removed, as it had served its purpose.

“I am not saying I did it. But what if I was the one to post the tweet? Then Trump will need to either admit to never having read the Babylon Bee article and posting this bullshit tweet, OR he will need to acknowledge that someone else posted the tweet.”

Breaking into a Twitter account to prove it is poorly secured is one thing, posting a tweet is another. “I took things further this time because our previous report obviously didn’t have any effect”, says Gevers. “I hope that everything will now be resolved soon, and that mister Trump sends us a message. ‘Thank you for your work/report.’ That should suffice and will round up things for both cases.”

The tweet is available right now?

https://twitter.com/realDonaldTrump/status/13170445563287306...

Why not post a hash of a timestamped transaction on the blockchain? Wouldn't that be better for establishing credibility instead of this?

Agreed. If the password was that simple it would have hacked a while back

Two economists were walking down the street. The first one says: “Isn’t that a $20 bill?” The second one says: “Can’t be. If it were, somebody would have picked it up already.”

Saw a $20 on the ground in front of the elevators at a hedge fund last year. Lobby full of employees. True story.

Naturally; any employee picking it up would be immediately fired, for disbelieving in efficient markets :)

I agree. I'm very skeptical that twitter doesn't have some special safeguards in place, nevermind Trump.

I mean who knows how many intelligence agencies are reading his DM's. If I knew Trumps password I wouldn't do anything that would make it clear that I knew it.

> I mean who knows how many intelligence agencies are reading his DM's

I'd be surprised if Twitter didn't have access logs. Anyway if his campaign team had the password, there may be nothing of value in those dms.

Intelligence agencies don't need his password to read his DMs on twitter.

It's from The Guardian, of course you should take it with a grain of salt.

Reply on news.ycombinator.com