Twitter for Android Security Vulnerability(privacy.twitter.com)
privacy.twitter.com
Twitter for Android Security Vulnerability
https://privacy.twitter.com/en/blog/2020/twitter-for-android-security-vulnerability
27 comments
I got it on my Mac laptop. I have an Android phone, but it's running Android 10, which isn't vulnerable.
I wonder what the actual vulnerability was. The article links to an entire bulletin of fixes.
I wonder what the actual vulnerability was. The article links to an entire bulletin of fixes.
I got this notification on my iOS device, I have never used twitter on Android. I think they just sent it out to everyone.
identified October 2018
fixed August 2020
Good job Twitter
https://source.android.com/security/bulletin/2018-10-01
fixed August 2020
Good job Twitter
https://source.android.com/security/bulletin/2018-10-01
The security patch from Google is from October 2018 it looks like.
So Twitter is to blame for not coding a mitigation for vulnerable devices? Or is it the phone manufacturer's fault for not releasing security patches for their phones?
So Twitter is to blame for not coding a mitigation for vulnerable devices? Or is it the phone manufacturer's fault for not releasing security patches for their phones?
As if we needed additional evidence that Twitter doesn't take their security as seriously as they should.
Better yet: don't install the Twitter app, and instead use m.twitter.com, which works perfectly and stays entirely within the browser's sandbox as it should.
You can have a separate icon for that as though it were an app, and if you really want to, you can enable push notifications just as you could with an app.
You can have a separate icon for that as though it were an app, and if you really want to, you can enable push notifications just as you could with an app.
I'm often getting some form of "you're rate limited", "not allowed to perform this action" etc. until I hard-reload the full page.
Given that others have reported it, and it's been there for a long time, I suspect Twitter at the very least intentionally doesn't put too much resources behind the web site to force people to use the app.
Of course, if a service really wants to push an app onto me, it's clear that the app gives them some real benefits, and its usually the kind that aren't a benefit for me (more tracking, better ways to push ads, more "engagement" notifications, ...). So the harder something wants to push an app, the clearer it is that I never, ever want their app to touch my device.
Given that others have reported it, and it's been there for a long time, I suspect Twitter at the very least intentionally doesn't put too much resources behind the web site to force people to use the app.
Of course, if a service really wants to push an app onto me, it's clear that the app gives them some real benefits, and its usually the kind that aren't a benefit for me (more tracking, better ways to push ads, more "engagement" notifications, ...). So the harder something wants to push an app, the clearer it is that I never, ever want their app to touch my device.
> I'm often getting some form of "you're rate limited", "not allowed to perform this action" etc. until I hard-reload the full page.
I thought I was the only person dealing with this.. It happens for pretty much every tweet that I open in a browser. After a refresh, everything loads fine, but it's quite annoying.
I thought I was the only person dealing with this.. It happens for pretty much every tweet that I open in a browser. After a refresh, everything loads fine, but it's quite annoying.
Yeah, I always thought it was because I use a VPN but maybe not.
I get that for most tweets I open (not logged in - I don't have an account) in my mobile browser. I get a much better success rate if I open it in private browsing mode.
I get this every single time a tweet opens in the iOS web view. I have got their app but either they or Apple or someone screwed something up and tweets never open in it.
Interesting, every single time for me in Firefox for Android, I figured it was some kind of bot detection because of my less-than-common user agent.
I think it's intentional. It doesn't happen when I am on desktop using the same site with virtually no change. Are you also using Firefox by any chance?
My experience is that the web app does not work perfectly. In fact I get an endless spinner >50% of the time and lord help me if I try to open a comment thread.
No kidding! I rarely look at Twitter, but if I do, in 50% of cases I have to refresh the page to get any content to show. I thought I was the only one.
I've never seen that, even on very large threads. (Using it in Firefox for Android here.)
Agreed. I rarely use Twitter anymore, but when I do, I use the mobile site, and it's awful in my experience. My phone is about 1.5 years old, but I don't think a website should struggle to load on a somewhat old phone.
A 1.5 years old phone is not "somewhat old"... if anything, it is pretty new.
In many countries, it is not even out of warranty!
Yes, some people change phones every year, but that does not mean the device itself is old just because you change it.
In many countries, it is not even out of warranty!
Yes, some people change phones every year, but that does not mean the device itself is old just because you change it.
And if you still insist on having an app, you should be using a third party one anyway. The official one is simply not a good experience in my opinion.
Although now that I think of it, maybe that's not such a good idea if you're using Android, given the lack of moderation on Google Play. I don't know what the third party Twitter app ecosystem is like on there, but I'd be cautious and meticulously vet the developer of any app you're considering trying.
Although now that I think of it, maybe that's not such a good idea if you're using Android, given the lack of moderation on Google Play. I don't know what the third party Twitter app ecosystem is like on there, but I'd be cautious and meticulously vet the developer of any app you're considering trying.
You can save yourself a 301 by typing mobile.twitter.com
If only old hardware/phones could get OS security updates by any mechanism.
I have a growing drawer of old hardware that is perfectly functional but no longer updateable.
I have a growing drawer of old hardware that is perfectly functional but no longer updateable.
They're awfully vague about exactly what the vulnerability was and what could exploit it. I thought the sandboxing between apps would be quite solid and well-tested. Did that break somehow, or did the Twitter app have some kind of insecure API for other apps to interface with the local Twitter app?
I got this alert and have never installed any Twitter app.
I find the "Our understanding" language strange. Presumably this number comes from some kind of metrics, but it seems like a bit of CYA language?
Still, appreciate the heads up for something they AFAIK didn't have any obligation to give a notification for.
[1] https://i.imgur.com/8dJ9Eq3.png