After reports of all of Parler's data being downloaded by third parties, analysis shows Parler lacked basic security measures to prevent such a data breach
Parler users breached deep inside the U.S. Capitol, as shown by GPS data pulled from videos archived by @donk_enby just before Amazon's takedown. https://gizmodo.com/...
The Parler game: “Massive numbers of posts that discussed the insurrection before, during, and after it was carried out will be preserved indefinitely so that they're available to researchers, journalists, prosecutors, and others.” https://arstechnica.com/...
A Reddit rumor was going around yesterday that hackers downloaded nearly all of Parler's data with a 2fa bug that let anyone create an admin account. Yes, hackers grabbed all of Parler's (public) data. But the truth of how they did it was far simpler: https://www.wired.com/...
Parler lacked the most basic security measures that would have prevented the automated scraping of the site's data Haven for hate speech Haven for data's grab https://www.wired.com/...
Reminder: the FBI generally has to use actual legal process to obtain information about people. This is a good thing, even when the people in question are insurrectionists. https://twitter.com/...
Great @a_greenberg summary of what went down at Parler yesterday. No, it wasn't a hack. Yes, it was just as bad. Parler doesn't “harvest personal data,” was Matze's pitch. [Narrator: It did]. https://twitter.com/...
Insecure direct object reference by using sequential/incrementing ID values for content that can easily be guessed & downloaded. This class of bug has been in and out the OWASP top 10 for years but we come across it on a weekly basis during assessments. https://twitter.com/...
the reddit story about 2fa bypass and admin accounts was completely bogus. the real truth is: - iterable post IDs that were 100% public and open to everyone - literally exactly what weev did (fucking ironic, no?) - only public posts were scraped/archived. https://twitter.com/...
“This is as bad as it gets,” White says. “It's gross incompetence on the part of Parler. They marketed themselves as a private, secure, unmoderated platform, and instead it's comedy hour.” https://www.wired.com/...
Helpful that the app intensely concerned with user privacy was not stripping any metadata from what users uploaded, making it by far the most law enforcement investigation friendly social platform yet https://twitter.com/...