Parler user data exposed and exfiltrated
alpha.facebook.com
alpha.facebook.com
Edit: OK, I just read the Twitter feed of the poster in the screenshot. This is a massive misinterpretation of what the archivists are doing. They're doing an archival web crawl and sharing a docker image for volunteers.
Edit: A quote on the matter from my friend working to archive the content,
"so tldr if you care/want to share on HN: the android app either used or had references to an api endpoint which let you transform a sequential id into the uuids that are used on the other endpoints. someone enumerated that."
"afaik that's literally it"
Further Edit:
https://github.com/d0nk/parler-tricks is what they're using to enumerate the resources
I know one major red flag for me was all the verification Parler was requesting. SSNs, and all that. There's no way that can end well.
that's some grade-A trolling right there. Congrats. All the Qanon et al.posts start the same way. i.e. I have it on good authority that....X will happen by Y tonight. blah blah blah. The storm.
Edit: I Read the posts from the relevant twitter account which shared some screenshots. Some of the lines from this facebook post other twitter posts are I think still a bit of stretch / speculation, but it definitely seems parler's data has been lifted by a number of parties.
I guess they're quoting this twitter account? https://twitter.com/donk_enby
edit: not sure about the no-fly stuff, that may as well be made up
Edit: I have now seen the Twitter account and relevant screenshots / posts, thank you for making me take another look
It looks like they're reverse engineering an iOS app
Would that not be massively unconstitutional? Surely law enforcement isn't allowed to use illegally-obtained records?
It's inadmissable in court, but that data can be legally used as tips, leads and to inform an investigation for more legal data collection avenues: it's called Parallel Construction: https://en.wikipedia.org/wiki/Parallel_construction
An example would be a police tip phone-number: it's all hearsay (unless it's a confession) and largely cannot be admitted into court directly, but it definitely leads to collecting solid evidence later on by investigators who can get warrants.
At this point were in national security letter territory.
The issue is that 97% of all federal court cases are settled before trial and never reach that stage because people often admit guilt and take a plea deal and don't know their own rights.
Also relevant: https://youtu.be/d-7o9xYp7eE
- Former startup founder and Amazon dev meets beautiful Russian woman in Vegas
- Whirlwind romance
- Married in Russia
- Travels Russia for 6 months allegedly having meetings with tech people and lawyers
- Comes back to Vegas and starts social network with 'secret' (eg not publicly disclosed) investors.
None of that is necessarily a smoking gun. It could be entirely legitimate and above board, and just the story of how someone started a business that's right on the edge of what's socially acceptable for many people. But if you wanted to build a honeypot social network in the USA that is pretty much exactly how you'd do it.
One of them is Rebekah Mercer
But impressive technical feat. I'd like to understand what exactly Twilio disclosed in their press release, to be able to secure a service if that information is disclosed about a service of mine.
If you are going to plan a coup, don’t register your phone number and upload a copy of your Drivers License with your photo, name, and address.
This is probably the most incompetent insurrection since the Whiskey Rebellion.
(That would be against GDPR in the EU, but probably not against US law.)
Would that be a good thing, a bad thing or something in between?