When you purposefully leak private data, you no longer get to hide behind the title "Security Researcher".
How does that change things? The article calls them security researchers. In the title! Isn't that an example of something that HN is tacitly acknowledging to be true by leaving the title alone?
Additional interesting things: the DOSing of Tor v3, suppression of all Trumpian sites, the blackout of Pakistan, the massive volatility of monero.
This sentence specifically:
> With this type of access, newly minted users were able to get behind the login box API used for content delivery. That allowed them to see which users had moderator rights and this in turn allowed them to reset passwords of existing users with simple “forgot password” function. Since Twilio no longer authenticated emails, hackers were able to access admin accounts with ease.
Compare to this comment[1] (linked from MeFi) posted this morning:
> Well, because of that access, it gave them access to the behind the login box API that is used to deliver content (...)
Subsequent posts also seem to indicate that post is incredibly inaccurate[2].
So it looks like someone mixed up "scraping a public API" with some breathless tale of hackers doing hacker things, and HN ate it up.
[1]https://m.alpha.facebook.com/groups/majordomo/permalink/1016...
[2]https://www.reddit.com/r/ParlerWatch/comments/kv0jo6/psa_the...
[0] trial by ordeal
That "fuck businesses", while "leave actual people ok".
I do see a public good in providing this data to law enforcement, so that they can obtain evidence to build a case against the people who were involved. I however can not see any public good in potentially exposing random people to identity theft and criminal harassment for simply registering an account on a website.
While people could make the argument that the site has culpability for what happened so this data must be exposed, to hold that position in good faith you would then also have to say that a leak of Twitter, Facebook, and Youtube users is also justifiable. Seeing as those platforms have held worse calls for violence than any other platforms.
Parler isn't a website where all the users who register are guilty of espousing harmful rhetoric. I would agree that there are some websites that exist like Stormfront where that would definitely be the case, but ultimately Parler is simply an alternative social media site with more lax moderation than Twitter. That lax moderation unfortunately will attract a large number of bad actors who have been banned from other sites. However this still doesn't change that this site isn't anything but a social media site with a different philosophical opinion on how moderated speech on their platform should be. Which means a lot of innocent people with no political power will be harmed.
Parler is not good, but stealing and publishing this information is also not traditionally ethical.
(Not 100% sure if private data was released.)
Not sure what I should've expected given the average user of HN.
Personally I don't care about the difference but just mentioning "pronouns" seems to be enough to trigger the downvote reflex - "pronouns" has been abused to create so much drama the last few years that I can kind of see why people react even if I don't do.
https://thetab.com/us/bucknell/2016/10/18/john-podestas-crea...
No.
> WikiLeaks founder Julian Assange phoned the White House to warn lives would be put at risk by the publication of cables online, a court has heard.
> On 25 August, 2011, German news outlet Der Freitag revealed that it was possible to access the unredacted database of cables by using a mirror site and a 58-key password that had been published in a book by The Guardian earlier in the year.
https://www.independent.co.uk/news/world/americas/wikileaks-...
No. Wikileaks did indeed accidentally give out the decryption key to the encrypted trove they published from the Manning leaks. There is probably still a torrent available of the full, unredacted scrape of Secret data from the SIPR network.
https://news.antiwar.com/2020/12/16/recording-proves-assange...
>> WikiLeaks had originally followed a policy of redacting personal or sensitive information from documents prior to release,...
Not really. If they had sent it to a journalistic organisation à la the Panama Papers, where e.g. curious peoples’ government IDs could be stripped and criminal activity highlighted, that would have be been different.
I think there's a real argument that this data is in the public interest.
A good half the problems in the world are created when we try to force oversized round pegs through undersized square holes. Besides which, was Parler not the site that required excessive amounts of personal info just to sign up?
That means if authentication failed open, that could mean that this researcher has obtained access to reams of PII. Which they'll deny or state that of courae they didn't collect or look at, but the potential breach is large enough that doing something like this is so unconscionably reckless and stupid, it ranks right up there with the event that even has this site in the public eye in the first place.
Another brick through the stained glass windows of American civil discourse. We don't even need other country's help to push us to the brink because of reckless moves like this.
Liberty is always opposed to security. How free we are depends on how worried we are. That's always the case.
By the way, lets look at some other circumstances:
Suspension of habeas corpus. Abraham Lincoln, Civil War. Half of country wants to clock the other half. Total existential threat.
WWI. Schneck v. United States. Cornerstone and terrible case for limiting free speech in order to silence opposition to the bloody draft.
WWII:Japanese internment camps. Labor cracked down on for striking and shutting down most of the wartime manufacturing supply chain. Existential threat.
2001: 3 buildings hit with aircraft. All liberties around airtravel basically cancelled. Heavy intensification of SIGINT intensifies, birth of widespread dragnet surveillance programs.
2020: A bunch of people waltz into the Capitol pissed as all hell because their concerns were not taken seriously. Rest of country is just fine. Suggestions to yeet civil liberties because think of the Congresspeople who had to continue their meeting elsewhere!
One of these is not like the others. Further, Congress is getting what it deserved. With the way they've spent years delegating increasing chunks of lawmaking to the Executive branch, ain't it grand the way they get reminded of why checks and balances were there in the first place?
Obviously we disagree on what it means when an angry mob chants about hanging the VP, breaches one of the most secure buildings in the country, and swears to try again.
This is obviously not an existential threat to you, but it is to the majority of the country, and certainly to our institutions.
Edit: I suppose not.
Lin Wood didn't say that on Twitter, because he had been previously banned on Twitter for similar rhetoric. Not sure about his status on Facebook, but Parler was absolutely where this stuff was happening.
The denial here is just wild. Like... this is all over the news.
Edit: some collated examples that just went by on my twitter feed, including the Wood threat: https://twitter.com/drewharwell/status/1348463074295107585
> Do you know how many of the people arrested in connection with the Capitol invasion were active users of Parler?
> Zero.
> The planning was largely done on Facebook.
[0] https://twitter.com/ggreenwald/status/1348619731734028293?s=...
edit: bad formatting
> Do you know how many of the people arrested in connection with the Capitol invasion were active users of Parler?
No, and neither does Greenwald, because its not like Parler has a real-name-to-account lookup function he has access to, or authorities have compiled and released breakdowns of all the social media accounts of arrestees, etc.
At best, Greenwald is fallaciously treating absence of information about their Parler use as information of absence of such use, at worst he's just making stuff up.
> The planning was largely done on Facebook.
Planning, including for the violence, was done on Parler among a wide variety of different sites. Actual journalists who are interested in investigating and reporting facts, and who haven’t abandoned actual journalism for pure ideological propaganda like Greenwald, have covered this, including the content of specific posts:
https://theconversation.com/far-right-activists-on-social-me...
https://www.propublica.org/article/capitol-rioters-planned-f...
https://www.forbes.com/sites/jemimamcevoy/2021/01/07/capitol...
https://www.vox.com/recode/22221285/trump-online-capitol-rio...
[1] https://twitter.com/donk_enby/status/1348666166978424832
If I were sitting on a dataset like this, I'd probably try to share it with the authorities like the FBI and selected journalists who I feel would behave responsibly.
If I were twitter user @donk_enby I would be very worried about an imminent visit by law enforcement.
These hackers aren't the heroes they pretend to be.
There is no way a non-tech savvy person can foil the federal government agency in this way - an agency which will likely have all the logs from Amazon (in addition to the data dump from this particular hack, and cached data from Parler follower's devices which will be duly imaged). In reality, any such amateur cleanup activity will be brought forward as further evidence of guilt (or as an additional charge).
I am tech savvy, and I am not foolish enough to think can possibly hide information from a nation-state, should one choose to turn it's Sauron's-eye-like gaze on me. Hell, I don't even stand a chance against a VC-funded security firm with <10 people that's worth its salt.
On the other hand if an actual researcher leaks data they're still a researcher; they might be a bad person, but that's orthogonal.
I would disagree. To me at least, the difference between researcher and hacker is what you do with the knowledge you have.
But my point wasn't that people can't have their credentials revoked for doing bad things, my point was that if actual security researchers -- say, a team from some university or prominent firm -- had done this, we would be having a very different conversation right now. We might stop calling them researchers next week, but history matters.
As far as I can tell, the people who broke into Parler are not far beyond script kiddies, if at all.
A researcher seeks knowledge, a hacker seeks ways to apply knowledge to overcome obstacles, which includes seeking required knowledge and is knowledge itself.
The more interesting question is in what capacity someone was acting, if it wasn't both.
Anything else is like trying to find the difference between an employee and a pilot, as if they're mutually exclusive things.