Weren’t the posts immediately reappearing after they were deleted? It doesn’t matter what Twitter restricts the way the platform is currently setup if their system is compromised you don’t have control over what is posted.
An alternative approach would be for twitter to support digitally signed tweets and build the signature validation into their clients. Obviously it’s said than done but it greatly enhance security and theoretically mitigate attacks like this by requiring access to the private keys to post fraudulent tweets, something Twitter would never at any point have possession of. Further, users very concerned about Someone hijacking their account, such as coinbase, could employ hardware security modules which would require the hacker to have physical access to the device and make a many user attach such as this previous one much less likely.
In response to serious attacks like this, you generally want to toss on defense-in-depth mitigations rather than try to come up with a theoretically perfect strategy.
6 comments
[ 2.8 ms ] story [ 25.6 ms ] threadAn alternative approach would be for twitter to support digitally signed tweets and build the signature validation into their clients. Obviously it’s said than done but it greatly enhance security and theoretically mitigate attacks like this by requiring access to the private keys to post fraudulent tweets, something Twitter would never at any point have possession of. Further, users very concerned about Someone hijacking their account, such as coinbase, could employ hardware security modules which would require the hacker to have physical access to the device and make a many user attach such as this previous one much less likely.
It’s not theoretical, it’s widely used and mature technology