A Twitter app bug was used to match 17M phone numbers to user accounts
Very relevant: <a href="https://news.ycombinator.com/item?id=21747424" rel="nofollow">https://news.ycombinator.com/item?id=21747424</a><p>Can this be an API leak which Chinese MSS used to track Chinese users?<p>It may well as be if we believe that API wasn't implementing discoverability restrictions from privacy settings, and only hid users on the UI level.<p>> Basically Twitter got pwned big time, and now denies it because GDPR will ruin them if breach is proven.
Here is what Doubi's online followers figured:<p>> State security got all phone numbers used for Twitter phone verification up to May 2019 and possibly till July.<p>> Twitter haphazardly closed the breach in complete secrecy.<p>> API hole explanation is excluded as people with 100% private accs got police visits.<p>> People with foreign SIM cards also got into trouble. So the explanation that China compromised Twitter's SMS providers is also excluded, as its improbable that they did it in 4+ countries.<p>> 2016 breach is also out of question.<p>> The only explanation is that they got hold on a big piece of their user DB, or, worse, they have an active infiltrator in Twitter, or Twitter voluntarily cooperated.