Twitter Okta Leak Exposes Class of "Protected Users"

Update: Leak confirmed by vx-underground.

https://files.catbox.moe/60azcq.png

Update 2: Twitter account sharing the leak suspended as of minutes ago:

https://x.com/TheAntifaTurtle/ https://x.com/TheAntifaTurtle/status/1816199705598255470

Maybe I'm missing something, but why would a list like this be stored in Okta vs Twitter itself? Seems sketchy from a purely mechanical standpoint.

Tangentially, I find it especially important to question evidence which so easily confirms my preexisting biases.

I saw some folks on Twitter pointing out that "TatetheRailsman" is likely a typo of "TatetheTalisman", which is Tristan Tate's (Andrew Tate's brother) account. Weird that it would be typo'd in their list of protected users. I also don't really buy this from a technical perspective. Why on okta? Why is the list of users and keywords so short? Why is everything a screenshot?

I’m skeptical. This just doesn’t make sense. If I was on this dev team, aside from objecting like crazy, I would be throwing a fit over the level of unnecessary complexity here. All this would take is an associative array, or dictionary, or map, or whatever your language calls it. Why tf would this be stored in okta. I see only 2 possibilities.

1. Elon fired everyone that knew what they were doing and this is a product of incompetence. 2. It’s fake.

The fact that the list only consists of known right-wing accounts and confirmed mouthpiece accounts is pretty suspect. Also that this was available from a public facing Okta url makes no sense.

You'd think a "leak" would reveal several other, as of yet unknown users, right? Not even a few internal test accounts? Some of them are even misspelled.

Occam's razor is that someone doctored a random page and threw in every well-known salacious account and then screenshotted it.

Why would such a list be associated with usernames (which are changeable) rather than the unique user ids? if this isn't fake then it's implemented poorly

This looks really fake, especially the anglo-centric british-english list of slurs rather than American slurs.

And the list of slurs is so short and incomprehensive almost like someone made it for a screenshot based on whatever came to mind

- The domain name doesn't resolve.

- The Okta URL that's just a unix timestamp from 12 hours ago.

- There's a missing/wrong cert per the original screenshot (given all other points, likely just a local /etc/hosts override)

- A misspelled list of rightwing accounts

- A very esoteric list of slurs, with some British/Australian stuff specifically

- It's an Okta SSO config.

This is definitely fake.

Wouldn’t they store user IDs instead of handles to make this more permanent since handles can be changed pretty easily?

on top of what others have said, this seems super fishy.

I'd like to see confirmation.

This is obviously fake. As tech-savvy users, you should easily be able to verify this.

The subdomain cannot resolve as it does not have a valid cert, and okta does not have an API to do this.

Come on fellas, do better.

as much as I dislike the current state of Twitter (now X (formerly Twitter)) and I'm aware of its biases - what is that serialization format? kebab-cased key names? no quotes around strings?

if it is real - keyword here being if - Twitter would have to had created its own parser for this. while not hard, why wouldn't they just... use something like JSON? YAML? TOML? ...XML?

i'm also not sure why would they host a configuration file like this out on the open web, when it's accessed strictly by the backend. why? what's the point...?

somethings fishy here, can someone clue me in on this...?

Did they take down the subdomian?

Ya got the discord link?

Ya got the discord url?

Interesting indeed

Notably, alongside right-wing accounts, the official Russian accounts are also listed.