Hector Martin

So yeah, it was just compromised internal credentials with the ability to take over user accounts. This is a big no-no and clearly the controls around those internal tools were woefully inadequate. This points to deficient security culture inside Twitter.https://twitter.com/TwitterSupport/status/1283591848729219073 …

Also, that the internal account takeover happened at *all*, presumably remotely, is inexcusable in 2020. If your corporate authentication does not require non-spoofable 2FA (e.g. U2F/WebAuthn) to achieve this level of access, you are doing many things wrong.

And apparently Twitter is retaliating against users tweeting screenshots of the internal tool (even censored of private info), which speaks volumes as to their priorities during this kind of massive security incident.

Remember this is apparently a *support tool*. The issue of insider access from *engineers* is a tricky one, because ultimately engineers need to be able to engineer the system. It's possible, but tricky, to build sufficient controls around engineering procedures.

It is not clear that this was a support account that was accessed rather than an engineering account. Engineers often have access to support tools, especially if they are responsible for them.