Right, I did some reading and here’s what likely happened with Parler. Lots of crossed wires here.

First up: someone noticed that Parler uses sequential integers in the API endpoint to get content.

An API endpoint is just a URL with a value added onto the end that tells the system what you want to get back.
Using sequential integers means that a hacker can set up an automated script to start at 1 and count up, trying API calls over and over again, to get back content from Parler.
Parler apparently had no restrictions on this API endpoint, which frankly blows my mind as a web dev.

If you had a working URL, it just spat out whatever it had whether you were logged in or not.
It seems that EVERYTHING that had been uploaded - video, photos, text posts - was accessible whether it had been deleted or restricted in the app itself. Even uploaded photos of licenses etc etc.

I cannot describe how amateur hour this is, if true.
Now as well as that - Parler got kicked off Twilio so now there was no verification of phone numbers on signup. They let it fail open - allow registrations without verification. Hackers used this to create umpteen accounts, for shits n giggles apparently.
I think they closed registrations after the damage had been done.

Okay so the admin accounts - they discovered an API endpoint that let them enumerate admin users.

This is also so unbelievably bad that it boggles the mind, from a web dev perspective
Like I don’t even know why that exists. That is not something that should exist.

The admin accounts were not compromised, apparently, but holy fucking shit you DO NOT expose admin account data EVER. That is asking to get hacked even more.
Anyway the TL;DR on this is that your password probably hasn’t been compromised (I hope) but anything else uploaded to Parler might be out in the wild now even if you deleted it in the app.

Happy fucking Monday, let the train wreck of this week begin
Further update: some lively discussion of it going on here: https://t.co/swpV9JUJ5p

More from Internet

The new tactics to implement the #CancelCulture are quite ingenious. They are not going after what they want cancelled directly, they are going after how it gets to you! It’s attacking the free market, and it’s harder to spot and harder to fight before it’s done! Read on!

1/


Here’s an example. If there’s a challenge to the normal Social Media platforms, then they aren’t wasting time going after the new app, they are making the app unavailable well more difficult to get. This puts people off from going to the trouble or switching.

2/


They are going to do this in a way you won’t see it coming. They are going to stop it before the source.

Soon, the media is going to be a complete left wing echo-chamber. Social Media, TV and Papers all left wing and you don’t get to say “what about free speech?”

3/


Why? Because they aren’t playing against free speech. They are going after the free market. This also gives you an idea what socialism can and will do.

I don’t expect my account to last long now I’m watching this and exposing it! Please share, stand your ground and don’t quit!


Here’s the proof that CNN are trying to get Fox cancelled at the broadcast level, stop it getting into people’s homes by getting the TV providers to ban it. Again, targeted before what we see as the source. This is also the groundwork for any
🚨 🦮 Seven ways to test for accessibility using only what is already in browser developer tools of Chromium browsers https://t.co/C7kdbigHGE

@MSEdgeDev @EdgeDevTools @ChromiumDev
#tools #accessibility #browsers
Also, a thread: 👇🏼


Issues pane, powered by @webhintio, listing accessibility issues with explanations why these are problems, links to more info and direct links to the tools where to fix the problem.
https://t.co/4K5RynHhbg


The inspect element overlay showing accessibility relevant information of the element, including contrast information, ARIA name, role and if it can be focused via keyboard.


Colour picker with contrast information offering colours that are AA/AAA compliant. You can also see compliant colours indicated by a line on the colour patch.
Note: the current algorithm fails to take font weight into consideration, that's why there will be a new one.


Vision deficit ("colour blindness") emulation. You can see what your product looks like for different visitors.
https://t.co/bxj1vySCAb

You May Also Like