drawkbox

drawkbox t1_j6r24c5 wrote

This needs to be from third parties otherwise those who control the neural nets and datasets will be able to shroud information as "not generated" when it is clearly astroturfing or manipulated. Then they can throw their hands up and say "must be the algorithm or a bad dataset" for plausible deniability.

The new game is coming or here, and it is misdirecting blame to the "algorithm" when it is an editorialized set of data or filtered for certain aims.

Almost all algorithms and datasets are biased or editorialized in some way, laws need to be adjusted on that. You can't blame the "algorithm" for enragement, because enragement is engagement.

1

drawkbox t1_j6lsn93 wrote

These scammers must be either swapping out the numbers regularly, using one time verified numbers or they have some holes in twilio that are getting around this.

Would seem that most patterns for detecting this would be pretty obvious, twilio is just letting it slide probably for that revenue. Now that they got an FCC hit, revenue is threatened, and they will have to close the hole or stop allowing these patterns.

There might be a reason to constantly swap out numbers, but not many... Those should be highly looked at like when you make an app and have background geolocation services on, Apple really prods you to make sure you aren't abusing that. Twilio just seems to let this slide.

The fact that they have these plausible deniability policies that are letting scammers slide, probably due to more political spam demand, is another reason to not trust them for SMS/Authenticator authentication codes over Twilio SMS or Authy app.

There was a big Authy hack not too long ago.

Twilio and Authy also hacked recently. This also affected Okta/Auth0 and companies that rely on those dependencies like DoorDash.

Anyone still using Authy over Google Authenticator or Microsoft Authenticator is not doing good opsec. Twilio has always been sketch. This breach is damaging.

> U.S. messaging giant Twilio has confirmed hackers also compromised the accounts of some Authy users as part of a wider breach of Twilio’s systems. Authy is Twilio’s two-factor authentication (2FA) app it acquired in 2015.

> Twilio’s breach earlier this month, which saw malicious actors accessing the data of more than 100 Twilio customers after successfully phishing multiple employees, keeps growing in scale. Researchers this week linked the attack on Twilio and others to a wider phishing campaign by a hacking group dubbed “0ktapus,” which has stolen close to 10,000 employee credentials from at least 130 organizations since March.

> Now, Twilio has confirmed that Authy users were also impacted by the breach.

> In an update to its incident report on August 24, Twilio said that the hackers gained access to the accounts of 93 individual Authy users and registered additional devices, effectively allowing the attackers to generate login codes for any connected 2FA-enabled account.

> The company said it has “since identified and removed unauthorized devices from these Authy accounts” and is advising affected Authy users, which it has contacted, to review linked accounts for suspicious activity. It’s also recommending that users review all devices tied to their Authy accounts and disable “allow Multi-device” in the Authy application to prevent new device additions.

Okta breached as a result of the Twilio/Authy breach

> Identity giant Okta on Thursday also confirmed it was compromised as a result of the Twilio breach. The company said in a blog post that the hackers — which it refers to as “Scatter Swine” — spoofed Okta login pages to target organizations that rely on the company’s single sign-on service. Okta said that when the hackers gained access to Twilio’s internal console, they obtained a “small number” of Okta customer phone numbers and SMS messages that contained one-time passwords. This marks the second time Okta has reported a security incident this year.

> In its analysis of the phishing campaign, Okta said that Scatter Swine hackers likely harvested mobile phone numbers from data aggregation services that link phone numbers to employees at specific organizations. At least one of the hackers called targeted employees impersonating IT support, noting that the hacker’s accent “appears to be North American.” This may align with this week’s Group-IB investigation, which suggested one of the hackers involved in the campaign may reside in North Carolina.

DoorDash also caught up in it

> DoorDash also confirmed this week that it was compromised by the same hacking group. The food delivery giant told TechCrunch that malicious hackers stole credentials from employees of a third-party vendor that were then used to gain access to some of DoorDash’s internal tools. The company declined to name the third-party, but confirmed the vendor was not Twilio.

2

drawkbox t1_j6ls1h4 wrote

Yeah they target work phones because people have to answer more frequently. A message or call that is sent to a work phone that goes opened/unanswered then it looks like someone is slacking.

Most personal phones people just let go to message or just delete (without opening to evade image based tracking) unknown numbers, with business or work most numbers are new or unknown.

Sucks how they target them. Any phone number or text recipient they send to that answers/views will get more and more and more spam.

1

drawkbox t1_j6hj59v wrote

Worked on a bunch of SMS apps including a big one for samples/notifications and it was insane how the approval process was for the short code and all the support you need around it.

I am always amazed that scammers get around all of that. A weak platform could do that if they were allowed or essentially white listed then play plausible deniability about moderating these.

SMS was built off of the network diagnostic codes/network and so they regulate it heavily. The only way these scams are working is due to piggy backing on something that has the ability to spin up new shortcodes without much oversight.

13

drawkbox t1_j6hf1o7 wrote

Twilio and Authy are sketch and you don't really want that when login codes (SMS and authy authenticator) are present. This is besides all the spam. Good luck to those using them.

Twilio and Authy also hacked recently. This also affected Okta/Auth0 and companies that rely on those dependencies like DoorDash.

Anyone still using Authy over Google Authenticator or Microsoft Authenticator is not doing good opsec. Twilio has always been sketch. This breach is damaging.

> U.S. messaging giant Twilio has confirmed hackers also compromised the accounts of some Authy users as part of a wider breach of Twilio’s systems. Authy is Twilio’s two-factor authentication (2FA) app it acquired in 2015.

> Twilio’s breach earlier this month, which saw malicious actors accessing the data of more than 100 Twilio customers after successfully phishing multiple employees, keeps growing in scale. Researchers this week linked the attack on Twilio and others to a wider phishing campaign by a hacking group dubbed “0ktapus,” which has stolen close to 10,000 employee credentials from at least 130 organizations since March.

> Now, Twilio has confirmed that Authy users were also impacted by the breach.

> In an update to its incident report on August 24, Twilio said that the hackers gained access to the accounts of 93 individual Authy users and registered additional devices, effectively allowing the attackers to generate login codes for any connected 2FA-enabled account.

> The company said it has “since identified and removed unauthorized devices from these Authy accounts” and is advising affected Authy users, which it has contacted, to review linked accounts for suspicious activity. It’s also recommending that users review all devices tied to their Authy accounts and disable “allow Multi-device” in the Authy application to prevent new device additions.

Okta breached as a result of the Twilio/Authy breach

> Identity giant Okta on Thursday also confirmed it was compromised as a result of the Twilio breach. The company said in a blog post that the hackers — which it refers to as “Scatter Swine” — spoofed Okta login pages to target organizations that rely on the company’s single sign-on service. Okta said that when the hackers gained access to Twilio’s internal console, they obtained a “small number” of Okta customer phone numbers and SMS messages that contained one-time passwords. This marks the second time Okta has reported a security incident this year.

> In its analysis of the phishing campaign, Okta said that Scatter Swine hackers likely harvested mobile phone numbers from data aggregation services that link phone numbers to employees at specific organizations. At least one of the hackers called targeted employees impersonating IT support, noting that the hacker’s accent “appears to be North American.” This may align with this week’s Group-IB investigation, which suggested one of the hackers involved in the campaign may reside in North Carolina.

DoorDash also caught up in it

> DoorDash also confirmed this week that it was compromised by the same hacking group. The food delivery giant told TechCrunch that malicious hackers stole credentials from employees of a third-party vendor that were then used to gain access to some of DoorDash’s internal tools. The company declined to name the third-party, but confirmed the vendor was not Twilio.

−8

drawkbox t1_j69l2rk wrote

Well if it is better now that is good. eBay always has a little bit of sketch going on, not necessarily the company but some of the market but that is the nature of things, that is why newsletters and ratings and external curation is good where needed. However, companies even ones with ethics training will still have pockets of bad people, just like here. It is usually never the whole thing or most people, always a cabal.

1

drawkbox t1_j69foob wrote

True, though culturally maybe some of that still lingers. This wasn't that long ago, January 2019.

Would TCGPlayer have done the same actions on Unions if they weren't part of eBay, I don't know.

I just think this is such a wild story that any mention of eBay makes me thing how messed up it was that a company at the top did this to a freaking newsletter.

2

drawkbox t1_j68jlgw wrote

Yeah the CEO and seven members of the global security team for eBay were involved. It was run out of the company which is even more insane. The CEO was "not charged" but definitely was the driver or let it happen and approved.

> A cyberstalking and harassment campaign conducted in 2019 against an online newsletter led to charges made public in 2020 against seven members of eBay's global security team, as well as arrests of two of those charged. Wenig, the company's CEO at the time of the harassment campaign, has not been charged.

EBay stalking scandal

20

drawkbox t1_j67vdfs wrote

eBay has some sketchy leadership last while...

Anyone remember when eBay, from the top, harassed an old couple like they were some organized crime operation? Maybe there is something to that eBay/PayPal mafia name. Feels like half of it is money laundering.

It is way worse than you think. Almost like a mafia extortion / threat / fixer style team with threat after threat and following them around, sending them shit and all extremely fucked up. This is stuff the mafia does to people that are leveraged and they are forcing some "offer you can't refuse" shit.

> that Sunday, Steiner was simply surprised and dismayed to see the word “Fidomaster” spray-painted across his fence. He tried to clean up the mess before Ina, who was out paddle boarding, returned home but he failed. Ina recognized that the name matched an anonymous commenter on their newsletter, one who was particularly critical of eBay.

> “This was very unnerving,” Ina recalled in an interview with the Globe this week. “It didn’t make any sense.”

> Two days later, the phone rang. It was a taxidermy and animal parts shop in Arizona calling to ask about a purported order for the Steiners of a fetal pig. The Steiners’ delivery address didn’t match the billing address on the credit card used on the order, so the shop called to double check the order. Shaken, the Steiners canceled the order.

> “I thought, here we go, from online to the real world,” Ina said. “It was really scary.”

> The couple decided to call the Natick police, and an officer arrived at their house to take a report, they said. As the officer was leaving the house, he noticed a package by the front door. While David and the officer continued talking, Ina opened the package in the kitchen. Seeing bits of hair and skin, she screamed. Inside was a mask of a bloody pig face, like the one worn by a crazed killer in the “Saw” horror movie series. The officer added the details to his report.

> The Twitter abuse continued to escalate and even more bizarre deliveries arrived, the couple said. One day it was a book for David called “Grief Diaries: Surviving Loss of a Spouse.” Ina said she Googled the return address of another package, and when she discovered the sender was called Carolina Biological Supply Co., she feared they might need to call a hazmat team. A call to the company revealed the package was filled with live spiders and fly larvae; they turned it over to the police.

> A few days later, a florist arrived with a sympathy wreath for David. The driver told the Steiners he had come from Central Square in Cambridge and was instructed to leave the $255 wreath by their back door without ringing the bell. Ina snapped a picture, more evidence for the police, and debriefed the delivery man.

> “All of these small retailers, they were being weaponized to be used against us,” David said.

> On Aug. 15, the campaign took a darker turn. Unbeknownst to the Steiners, a group of Baugh’s employees had flown to Boston, rented two vehicles, and checked into the Ritz-Carlton Hotel, according to federal documents. They initially planned to plant a tracking device on the Steiners’ car. Luckily, the Toyota Rav4 was locked in the garage and the eBay team retreated to the hotel, the documents allege.

> But the next day the team returned. David Steiner was up on a ladder installing one of several new security cameras he’d purchased, while Ina handed him tools out of a second-floor window. Suddenly, Ina saw a dark-colored Dodge Caravan driving up their street. “Black van, New York plates,” she told David as the vehicle drove past.

>“We felt in danger, we felt like targets,” Ina said.

> The van took another pass by the house, as captured by one of the couple’s security cameras. Then, later in the day, David noticed the same van pull out to follow him while he was in his car with a friend.

> “I can still feel how every hair on the back of my neck stood up,” David said, as the van followed him for several blocks.

...

> On Aug. 18, David became determined to break out and go to the grocery store. Again, a vehicle, a silver SUV, started following him. He called Ina. “I’m going to take them downtown,” he told her, planning to drive to the Natick Police Department.

> The SUV followed at a distance. He pulled over and parked across the street from the police station. As the SUV slowly drove past, he propped Ina’s iPhone up on the steering wheel and photographed the stalkers. “I’m determined to take a picture this time, I just kept hitting the button,” he said.

> With a full license plate number in hand from David’s pictures, the Natick police quickly started to unravel the conspiracy. The vehicle tracked back to an eBay contractor who was staying at the Ritz.

That is just part of it...

Who the hell works somewhere and even cares enough about the company to protect it with literal stalking and threats? I mean is some criminal shit going on at eBay? Doesn't even make sense how it would get to that level.

62

drawkbox t1_j621q27 wrote

The moment China got ahead and took the Russian deal they abused their market position and showed they aren't a partner but one that will use leverage in ways that are excessive especially in a time of crisis. Taking the Russian "deal" and that always works out for those in history... /s

The China Market experiment is over, they turned East again.

The chips being built in the US will be the top tier and China played themselves by doing this leverage move.

Tim Cook says Apple will use chips built in the U.S. at Arizona factory

> The plants will be capable of manufacturing the 4-nanometer and 3-nanometer chips that are used for advanced processors such as Apple’s A-series and M-series and Nvidia ’s graphics processors.

> “Today is only the beginning,” Cook said. “Today we’re combining TSMC’s expertise with the unrivaled ingenuity of American workers. We are investing in a stronger brighter future, we are planting our seed in the Arizona desert. And at Apple, we are proud to help nurture its growth.”

> “And now, thanks to the hard work of so many people, these chips can be proudly stamped Made in America,” Cook said. “This is an incredibly significant moment.”

The production will be able to meet all US Apple demand for chips, and "capable of manufacturing the 4-nanometer and 3-nanometer chips that are used for advanced processors such as Apple’s A-series and M-series and Nvidia" which is huge as that is where the innovation is.

The chip market needs lots of competition to prevent what happened in 2020 with the chip shortage, market players manipulated the market when they obtained leverage and hoarded chips to prevent other industries from competing across GPUs, EVs, devices, etc.

Once the chip shortage happened, partially due to geopolitical reasons, that changed everything. The West/US will never fully rely on a single point of failure again no matter how hard the HBS MBAs and Chicago thinking push it to trim and be "efficient". Some industries are too important for other industries and leverage on that over those areas is too risky and costly now.

IN 2020/2021 I would have paid double right now for GPUs directly from the source, not from some sketchy third party.

Right now our EV/auto, military, space and even AR/XR industries as well as gaming and everything that requires chips, we are at the mercy of an external market that has a slant against the West. It will take some years to get out but we'll never not expect that in the future again. If costs go up costs go up, but availability should never be allowed to be used as leverage again, that is too risky and too costly long term.

Availability that is reliable is always more important than efficiency or cost, because right now lack of availability is costing lots of extra time that has the potential to lose entire industries, that is not acceptable in any way.

Very little margin and too much optimization/efficiency is bad for resilience. Couple that with private equity backed near entire market leverage monopolies/duopolies/oligopolies that control necessary supply and you have trouble.

HBS is even realizing too much optimization/efficiency is a bad thing. The slack/margin is squeezed out and with that, an ability to change vectors quickly. It is the large company/startup agility difference with the added weight of physical/expensive manufacturing.

The High Price of Efficiency, Our Obsession with Efficiency Is Destroying Our Resilience

> Superefficient businesses create the potential for social disorder.

> A superefficient dominant model elevates the risk of catastrophic failure.

> If a system is highly efficient, odds are that efficient players will game it.

Hopefully that same mistake is not made in the future. It will take time to build up diversification of market leverage in terms of chips for availability. Hopefully we have learned our lesson about too much concentration, with that comes leverage and sometimes a "gaming" of the market.

This chip shortage, and all the supply chain problems during the pandemic as well, will hopefully introduce more wisdom and knowledge into business institutions that just because things are ok while being overly super efficient, that is almost a bigger risk than higher prices/costs. Competition is a leverage reducer. Margin is a softer ride even if the profit margins aren't as big.

Plenty of industries are subsidized that make sense for resiliency to make them competitive, food being a big one, energy, electricity, water as well. I'd put chips in that category now.

Cost has to take into account leverage when outsourcing, for times like this where hoarding, trade wars, pandemics and geopolitical issues including manipulation have impacted supply. This affects all industries that ride on top of it.

Essentially the China market experiment is over. The largest chunk of the chip production is located there, most of the materials for chips is owned by them and they moment they reached a leverage state they used it.

China's Auto-Chip Hoarding Probe Should Be Worrying Distributors

China Stockpiles Chips, Chip-Making Machines to Resist US

There are other factors but ultimately authoritarians have plans to weaponize the supply chain and have. We'd be suckers to keep that leverage in place, it affects all competing businesses on top of chips.

> China is a large consumer of major commodities including crude oil and iron ore, but it relies heavily on imports to meet its domestic demand for those commodities.

> The country is diversifying its supply of critical natural resources by buying overseas companies and pivoting toward “stable autocratic regimes” for imports, said a report by Verisk Maplecroft.

> “By securing diversified sources, China will be in a better position to weaponise trade with geopolitical rivals,” the risk consultancy said.

China heavily subsidizes chips so we better to compete or else leveraged to authoritarian systems that don't like the West or open markets.

China’s Share of Global Chip Sales Now Surpasses Taiwan’s, Closing in on Europe’s and Japan’s

> Global chip sales from Chinese companies are on the rise, largely due to increasing U.S.-China tensions and a whole-of-nation effort to advance China’s chip sector, including government subsidies, procurement preferences, and other preferential policies.

You can't be efficient if you can't get materials for other industries.

Highly efficient capitalism moves away from a fair market to an oligopoly that looks more like a feudal or authoritarian system where the companies are too powerful and part of that power is absolute crushing of competition, that is bad for everyone even the crushers.

The same type of thinking led us to have a near single point of failure in trade on Asia for chips, and now look at us. Chip shortage for years all to save some percentage, we ended up leveraging the entire market to it.

15

drawkbox t1_j5h4tc3 wrote

Basically Google's Bell Labs, this will be a long term mistake.

Though, it is a typical McKinsey style consultcult HBS MBA-itis and Chicago thinking style though, gut R&D, the value creation center of your company in favor of value extraction only.

Sadly Google CEO Sundar Pichai went to Wharton and worked at McKinsey. Two massive HBS MBA-itis red flags. He does have some history on the good products at Google but something has happened and systems he thrived in for innovation are now being closed off.

Probably pushed the bureaucracy that is slowing productivity.

Bring back 20% time, where most good Google products were made. Simplicity is less management and less "sprints".

Agile was supposed to give developers/creatives more time, but it turned into an excessively shallow micromanagement consultcult tool with too much weight around it, so now everyone is in the critical path emergency all the time, closed mode over open mode all the time. The new form of "agile" is "a-gee-lay" like the misunderstanding that the Dad in Christmas Story had when he saw "fragile" and thought it was "fra-gee-lay". Micromanagement is how to kill innovation in one easy step, even better if you tell them the system of micromanagement is to "help" them "simplify". This new "agile" is EDD, Emergency Driven Development all day and night. Why even try to do things if you have so much weight to move and so many layers of approval? Remember, the creator of Agile said "Agile is dead" in 2015, but long live agility. Agility is what the McKinsey "agile" (a cult) has killed. Get out of the way management and let the people play in their labs. That is where innovation comes from and always has. AT&T labs back in the day even knew this. Early internet and app/game dev knew this. It was in control/power by the creators/developers and then value was created. The value extractors want to try to extract value before value is created.

Never ever trust those from Wharton... Trumps, Musks, Milner, John Sculley that nearly broke Apple, Warren Buffett, CEOs of many sketch companies like Comcast etc.

The finance/business has all the power over creatives/product/developers now. Until that changes they will be listing.

Google is in their John Sculley and Steve Ballmer moment.

38

drawkbox t1_j2em151 wrote

Great Game

Russian Empire was as active, if not more, than the British Empire. Russia was always very good about using fronts. Like for instance how they setup the Shahdom in Iran and had it protected by Russian soldiers for decades.

Russia is only a century out of tsardom, they still are into world domination attempts though.

2

drawkbox t1_j1tu9ke wrote

All these articles fail to recognize the biggest automation already happened, computers and internet. There is more work now than before. This last mile stuff is really hard and will take a long time, in many cases it will be more expensive with maintenance/upkeep. You can bet companies will have better healthcare plans for the robots though.

1

drawkbox t1_j1n8i16 wrote

I think their should be a whole separate organization and division of investigative forces that take each police conviction and really do the deep dives that never happen when police forces want to close cases quickly due to overwork and metrics. Lots of the suicides of high profile people for instance, or small town sketchiness where Sheriffs basically are mini kings, or enforcement scams. This type of police force would be heroes and they'd keep people honest who investigate.

21

drawkbox t1_j10mdib wrote

You as well.

Yeah some people forget to just base it on their own experience. At most companies, everyone knows the original funders have all the pull and all the control. Even if you IPO, even if there are large institutional shareholders. A new tactic of foreign money is setup the initial funding and companies, then draw in the West investment on top, but retaining control.

Many, many companies have been setup this way in the last two decades. For instance, Tesla got 85% of all pre-IPO and post-IPO funding from Chinese banks, that has leverage attached. Even this here reddit was setup that way (DST Global via Yuri Milner like Facebook, Twitter and others -- same funders of DraftKings)

1

drawkbox t1_j0xo8hm wrote

DraftKings is mostly funded from foreign entities from authoritarian places that hate the West. This is no surprise.

Use Fanduel or other casino sportsbooking.

EDIT: Funders are pre-IPO and control the board, subsequent funding and essentially everything about the company. Even with massively big investors post-IPO this is still the case.

22

drawkbox t1_j0wntzy wrote

COPPA rules are very clear, no one else is sweating.

> Rule Summary

> COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.

These rules have been in place since the year 2000.

> In December 2012, the Federal Trade Commission issued revisions effective July 1, 2013, which created additional parental notice and consent requirements, amended definitions, and added other obligations for organizations that (1) operate a website or online service that is "directed to children" under 13 and that collects "personal information" from users or (2) knowingly collects personal information from people under 13 through a website or online service. After July 1, 2013, operators must:

> - Post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from persons under age 13;

> - Make reasonable efforts (taking into account available technology) to provide direct notice to parents of the operator's practices with regard to the collection, use, or disclosure of personal information from persons under 13, including notice of any material change to such practices to which the parents have previously consented;

> - Obtain verifiable parental consent, with limited exceptions, prior to any collection, use, and/or disclosure of personal information from persons under age 13;

> - Provide a reasonable means for a parent to review the personal information collected from their child and to refuse to permit its further use or maintenance;

> - Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of the personal information collected from children under age 13, including by taking reasonable steps to disclose/release such personal information only to parties capable of maintaining its confidentiality and security; and

> - Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use.

> - Operators are prohibited from conditioning a child's participation in an online activity on the child providing more information than is reasonably necessary to participate in that activity.

Epic just was cheating trying to get more info on kids like TikTok for tracking/fingerprinting.

The COPPA rules are basically this, over 13, ok, under 13, you can collect no data on these users other than anon + ephemeral data. Should they want to buy anything or have anything beyond that, you have to have their parents approve via email and the child's account is essentially their parent.

If you use systems like Apple GameCenter, Google Play Game Services, Steam or other, all of this is already built in.

Epic Games clearly was cheating or didn't have their flows tight on this.

−1