From the viewpoint of Twitter, Facebook, Shopify and potential other social media/commerce services, banning and suspending Trump’s account makes sense. It is pretty straightforward for these services to make the case that his posts/tweets violate their terms of service [1].
I’m stuck by how quickly and totally Trump’s influence has been curtailed. His options are now (a) White House press releases, which he has until the week after next (b) the group chat app Parler that is popular with the fringe right, but which was also banned by Google Play and has been given notice by Apple’s App Store, (c) various subreddits, but Reddit has already suspended most of the popular ones (d) other potential social networks (including, say, the group messaging app Telegram) (e) his email lists (f) his own website
Only with his email lists and his own website is Trump fully in control. [2] Perhaps he could set up his own Twitter-like social network on his site with Mastodon. He could set up discussion forums on his site with Vanilla Forums or Discourse. All of this over and above built-in comments on his blog. It is likely that sooner or later Trump or an organisation linked closely to him will set up this sort of infrastructure.
But what he gets back in terms of control he loses in terms of distribution. Anyone who engages with Trump and his community on this website and forums is someone who has joined for that specific reason. No one other than news reporters covering Trump and his network will join.
With an account on broad-based social networks like Twitter, your ‘viral’ messages find their way into the feeds of people who have nothing to do with you. In this way, at least, Twitter works for you, distributing your message in a way that optimises for discovery of your account. You don’t need to pull people in; the platform pushes them to you.
This optimisation is one the most common criticisms of social networks – with an algorithmically picked feed, at its best, you discover new interests, make new friends, understand things better. But at its worst, your feed makes you more anxious, causes more outrage, causes you to be more polarised than you otherwise would be. This is how polemical figures like Trump gain both followers and detractors.
What’s important is that both sides are equally important to his popularity. And there’s an inherent danger in having only supporters on a platform.
On Twitter (and Reddit/Facebook), there have probably been hundreds of thousands of online fights between supporters and detractors of Trump. However ugly they may have been, they have served as an outlet for rage and hatred, a valve for emotional steam stirred up by Trump and TV channels.
For a while, I imagine these online squabbles will continue. But if and when Trump or an entity aligned with him sets up their own online infra like we discussed above, it’s going to be an echo chamber that surpasses subreddits like /r/the_donald or on the chat app Parler. Some of the frenzy may be let out on social media, but the risk is that the majority will play out in the real world.
This is the main second-order risk I see with a ban on Trump’s social media presence. I’m not sure we’ve understood this, leave alone acknowledged it.
[1] Whether it was too late, or whether they enforce these rules arbitrarily or selectively is another debate, and not this site’s focus.
[2] That is, as long as he uses his own infrastructure for them, as opposed to something like Substack for email and a wordpress.com site, which could both be turned off.
A subculture at this stage is ripe for exploitation. The creators generate cultural capital, i.e. cool. The fanatics generate social capital: a network of relationships—strong ones among the geeks, and weaker but numerous ones with mops. The mops, when properly squeezed, produce liquid capital, i.e. money. None of those groups have any clue about how to extract and manipulate any of those forms of capital.
The sociopaths [when they show up in a subculture] quickly become best friends with selected creators. They dress just like the creators—only better. They talk just like the creators—only smoother. They may even do some creating—competently, if not creatively. Geeks may not be completely fooled, but they also are clueless about what the sociopaths are up to.
Mops [members of the public; passive consumers of a subculture] are fooled. They don’t care so much about details, and the sociopaths look to them like creators, only better. Sociopaths become the coolest kids in the room, demoting the creators. At this stage, they take their pick of the best-looking mops to sleep with. They’ve extracted the cultural capital.
The sociopaths also work out how to monetize mops—which the fanatics were never good at. With better publicity materials, the addition of a light show, and new, more crowd-friendly product, admission fees go up tenfold, and mops are willing to pay. Somehow, not much of the money goes to creators. However, more of them do get enough to go full-time, which means there’s more product to sell.
The sociologist and writer Zeynep Tufekci on the reaction that one of her conjectures about the covid vaccine rollout received:
The third category of reaction, the most interesting from a public sphere point of view, was a version of “how dare I write about this”—given, obviously, that I am not an immunologist or a vaccine expert.
She surmises about how the innate need for in-group and out-group identification is magnified first by social media and then further in uncertain times like this pandemic. But to me the most interesting part is at the end, which is also what the title of her post, is about when, on applying for an academic job, she heard back only either from the very top institutions or the bottom. Of the latter, she says
… the episode also gave me an appreciation for the ones with nothing to lose… They were in many ways the outsiders, but they didn’t have as many chips on their shoulders because they weren’t playing the game in the first place. They weren’t weighed down with the status-climbing because they didn’t have a chance. They were free. In many ways, the open nature of status-climbing efforts on social media has taken away some of that freedom and reconfigured it, and how to recognize its distorting effects is worth thinking about.
Major streaming video services have declined to bid on a new documentary about the Saudi Arabian government’s alleged killing of a dissident. Netflix, in particular, was eager to bid on and list Icarus, the director’s previous documentary about the Russian government’s pervasive athlete doping programme but, according to the New York Times, did not even reply to the director about this documentary.
The same market forces that make streaming services great US stocks to own – Netflix, Amazon, Disney among them – also make them less inclined to pursue anything outside of a certain risk-free definition of entertainment, since a broader market inevitably brings broader constraints on what is acceptable.
I see an important role for independent publishers with a direct relationship with their audience in distributing new material like this documentary, especially those that collect payments directly from their readers/subscribers as opposed to via sponsors.
The messaging service Telegram intends to make money next year onwards, after being funded by its founder’s fortune. The announcement also makes its principles clear(in bold below):
All the features that are currently free will stay free. We will add some new features for business teams or power users. Some of these features will require more resources and will be paid for by these premium users. Regular users will be able to keep enjoying Telegram – for free, forever. All parts of Telegram devoted to messaging will remain ad-free. We think that displaying ads in private 1-to-1 chats or group chats is a bad idea. Communication between people should be free of advertising of any sort. We will fix [monetisation with intrusive ads in the absence of alternatives] by introducing our own Ad Platform for public one-to-many channels – one that is user-friendly, respects privacy and allows us to cover the costs of servers and traffic.
The goal of monetisation seems to be to cover running costs as Telegram approaches half a billion users, not to create another Big Tech company. The post mentions sustainability and independence as explicit goals:
Telegram is here to stay for a long time… [monetisation] will allow us to keep innovating and keep growing for decades to come… we will remain independent and stay true to our values, redefining how a tech company should operate
The best-case outcome for Telegram is becoming a pillar of the independent internet like Mozilla, Wikipedia, the Tor project, Automattic, GNU, among others.
Making money from your customers, your users is how you avoid being dependent on the largesse of one person or entity. Mozilla has not yet managed to crack it; I hope Telegram does.
A lot of people suppose that we started Substack to be the next big thing in journalism. But what we’re actually trying to do is subvert the power of the attention economy.
When engagement is the holy metric, trustworthiness doesn’t matter. What matters more than anything else is whether or not the user is stirred. The content and behaviors that keep people coming back – the rage-clicks, the hate-reads, the pile-ons, the conspiracy theories – help sustain giant businesses. When we started Substack to build an alternative to this status quo, we realized that a tweak to an algorithm or a new regulation wouldn’t change things for the better. The only option was to change the entire business model.
Substack’s key metric is not engagement. Our key metric is writer revenue. We make money only when Substack writers make money, by taking a 10% cut of the revenue they make from subscriptions. With subscriptions, writers must seek and reward the ongoing trust of readers.
Substack does two things differently from typical social platforms: one, by encouraging paid publications, readers pay to receive their information fix, which naturally caps the number of newsletters a person receives and by extensions the attention they capture. Two, it has aligned its revenues with these paid publications. These two by themselves are a significant departure from the norm, for the better.
There is always the likelihood, perhaps the inevitability that deliberately divisive, disingenuous polemical publications will publish on Substack for free, making money off sponsorships instead of reader payments, and they may amass large followings too. And Substack too has declared that they will be light with censorship:
we commit to keeping Substack wide open as a platform, accepting of views from across the political spectrum. We will resist public pressure to suppress voices that loud objectors deem unacceptable.
This will be something that Substack will have to reckon with, and perhaps soon. Yes, apublication with a generous enough sponsor – whether public or not – and a large enough audience is better off simply hosting their own newsletter infrastructure, which is not complicated. But they may also simply continue on Substack. What is the company to do then?
The possible answers are for another time. In any case, Substack’s approach to revenue and moderation, its recognition that they are interlinked, and its willingness to publicly articulate it, is commendable.
The youtube-dl takedown notice fell into a more unusual category: anticircumvention—an allegation that the code was designed to circumvent technical measures that control access or copying of copyrighted material, in violation of Section 1201 of the DMCA.
Section 1201 dates back to the late 1990s and did not anticipate the various implications it has for software use today. As a result, Section 1201 makes it illegal to use or distribute technology (including source code) that bypasses technical measures that control access or copying of copyrighted works, even if that technology can be used in a way that would not be copyright infringement. Circumvention was the core claim in the youtube-dl takedown.
Establishing that, the post then goes on to state that in their opinion, the youtube-dl project did not circumvent technical measures:
Although we did initially take the project down, we understand that just because code can be used to access copyrighted works doesn’t mean it can’t also be used to access works in non-infringing ways.
Then, after we received new information that showed the youtube-dl project does not in fact violate the DMCA‘s anticircumvention prohibitions, we concluded that the allegations did not establish a violation of the law.
This new information came through a letter sent by the Electronic Frontier Foundation’s attorney [PDF] to GitHub. This is the highlight of the whole story for how well it explains what youtube-dl does and does not do. Quoting from the letter, not necessarily in the order in which they appear in the letter:
when a user requests certain YouTube videos, YouTube’s servers send a small JavaScript program to the user’s browser, embedded in the YouTube player page. That program calculates a number referred to as “sig.” That number then forms part of the Uniform Resource Locator that the user’s browser sends back to YouTube to request the actual video stream. This mechanism is completely visible to the user simply by viewing the source code of the player page. The video stream is not encrypted, and no secret knowledge is required to access the video stream… Importantly, youtube-dl does not decrypt video streams that are encrypted with commercial DRM technologies, such as Widevine, that are used by subscription video sites, such as Netflix
We presume that this “signature” code is what RIAA refers to as a “rolling cipher,” although YouTube’s JavaScript code does not contain this phrase. Regardless of what this mechanism is called, youtube-dl does not “circumvent” it as that term is defined in Section 1201(a) of the Digital Millennium Copyright Act, because YouTube provides the means of accessing these video streams to anyone who requests them.
To borrow an analogy from literature, travelers come upon a door that has writing in a foreign language. When translated, the writing says “say ‘friend’ and enter.” The travelers say “friend” and the door opens. As with the writing on that door, YouTube presents instructions on accessing video streams to everyone who comes asking for it.
youtube-dl does not violate Section 1201 of the DMCA because it does not “circumvent” any technical protection measures on YouTube videos.
This is wonderfully explained, and the analogy is spot-on.
I do not expect Github’s lawyers to have understood this mechanism when they first received the takedown request from the RIAA, but one would expect them to have discussed this with someone technical at GitHub, who either knew or could have asked the project about this mechanism, and this technical person and the lawyers could have determined that it did not circumvent technical measures. My guess is that in an effort to project neutrality, they did not initially take a stance one way or another. Indeed, the blog post has a short section at the beginning titled “Why did Github process this takedown in the first place?” which doesn’t really address why they went all the way to removing the youtube-dl project if they understood the issue:
As a platform, we must comply with laws—even ones that we don’t think are fair for developers. As we’ve seen, this can lead to situations where GitHub is required to remove code—even if it has a multitude of non-infringing uses—if it is in fact designed to circumvent a TPM. But this is exceedingly rare.
I think it’s the EFF’s advocacy, finally in the form of a legal document, that gave GitHub the confidence – or cover – it needed to do the right thing. That combined with the public outcry against this.
A scammer can use the same tricks against you on your other accounts, like your Gmail. Such attacks are more common than you think. According to this BBC article from April, Google was blocking 100 million phishing emails a day.
What does a Gmail phishing attack look like?
Phishing techniques improve every day, and are quite sophisticated even today.
You could get an email that looks like it’s from Google, but is not, asking you to tap a button – it could say it’s for account maintenance, to accept new terms and conditions, to download a Google Doc someone’s shared with you or a number of other things.
When you click on the button in the email, you get a screen that looks like this:
This screen looks like it’s from Google, but it isn’t. The only way to tell is by carefully looking at the URL (the web address in the bar). For most of us who are perennially distracted, it’s really hard to tell the difference.
You enter your username and your password, but it’s read by the attacker instead of by Google. You have lost control of your account. Your attacker can now use Google’s security features against you and log you out – from your browser, your Gmail app, Google Docs – everything.
If someone gets access to your Gmail account, or any other email account like Yahoo, Outlook or iCloud, they could then get into other your other accounts – Instagram, Facebook, Snapchat – by sending a password reset email to that email account, and then changing the password.
How do I protect Gmail – and my other accounts?
Gmail has support for two-factor-authentication, that is, support for a second layer of protection beyond your password/OTP.
This second layer is a six-digit code that you enter after you have entered your email address and password on a new computer/app install. So you see two login screens, one after another, instead of one.
As we will see in detail below, the scammer may be able to trick you into giving up your Gmail password, but it’s really hard for them to be able to get your two-factor code.
Not just Gmail/Google, here is a list of common accounts that you can and should enable this two-factor-authentication for:
Gmail (or Google) account
Apple iCloud account
Facebook
Instagram
Snapchat
Linkedin
Twitter
Dropbox
But, you ask, how is it practical to remember six-digit codes for all these accounts? Surely it isn’t wise to use a single code for all these accounts.
That’s right. In fact, you don’t need to remember any of these codes at all.
You will use a new app, Authy, to generate new six-digit codes whenever you log into Gmail or these other accounts from a new phone or computer.
Authy is a dedicated two-factor-authentication app (now owned by the Internet infrastructure company Twilio.) You can see a screenshot of my own Authy app with two-factor set up for several accounts.
You can see that Authy’s auto-generated a code for one of my accounts which I can just type when I login. So I get the full benefit of this second layer of protection without remembering codes for any of these accounts.
You can install Authy on more than one device – say your iPhone and iPad. You can even install it on your desktop computers. You secure the app itself with an Authy password – which is the only password you need to remember (or store in your password manager).
Setting up your Gmail account with two-factor protection using Authy
Keep the following handy: the Gmail app on your phone. And a laptop browser window.
Now. Login to your Google Account Management page at accounts.google.com. Tap the “Security” section on the left. Scroll down to the “Signing in to Google?” section. You’ll see that “2-step verification’ is off. Click it.
Now you’ll go through a simple wizard to set up your two-step verification. Tap Next on the Introduction screen:
Tap “Continue” on the next screen, titled “Use your phone as your second step to sign in”
Now on the next screen, the wizard says that Google has sent a notification to your Gmail app.
Launch the Gmail app on your phone and instead of your inbox, you’ll see a login notification. Tap Yes.
On the next screen, “Backup”, tap “Use another backup option”
You’ll see a bunch of recovery codes. Tap “Download”. Rename the text file to “Gmail Recovery Codes” and save the file in your My Documents folder.
Just one more step: On the next screen, under the “Add more second steps to verify it’s you”, tap the “Authenticator App” section.
On the next screen, choose whether you have an iPhone or an Android phone. I picked iPhone, but the steps are the same.
On the next screen, you’ll see a QR Code displayed.
Now on your phone, open the Authy app. Tap “Add Account” and pick “QR Code”.
Scan the QR code on your laptop screen. Your Authy app will immediately identify and add the account. And start displaying six digit codes.
The screen on your browser will automatically refresh to ask for a six digit code. Enter the six digit code that’s displayed on your phone’s Authy screen.
You’re done! Now, when you sign in to Google or Gmail or Google Drive on a new browser on your laptop, or a new app install on your phone, you’ll enter both your username and password, and then the latest six-digit code on your Authy app. That’s it!
Logging into Gmail with your new, secure two-step flow
Here is what your new login looks like. First, your user name and password as usual:
Your account’s login screen will then ask you for your second-factor code.
At this point, you look for the code in the Authy app. Authy will generate a code that is valid for a maximum of 30 seconds.
Type this code in the login screen and you’re done!
Why two-factor authentication protects your Gmail account
Let’s go back to the example at the beginning of the post. We saw how you could receive an email that looked very much like it was from Google. It has a link for you to click – the email could say that it was for account management, reviewing and accepting new terms and conditions, or a number of other things.
You don’t review the sender’s email address, which Gmail and other email apps usually collapse, and you need to tap a button to reveal. You think it’s a legitimate email, click on the link, and are taken to a very realistic-looking Google authentication page, asking you for your email address and password, which you enter.
At this point, because the web pages were hosted by a scammer and not by Google, they now have your password. They can now log into Gmail – or your Google Account and prevent you from logging back in.
But if you had 2FA set up, once the scammer entered your email and password into the Google login screen, they would be asked for your second-factor code. They don’t have it. They have no way of going back to you and asking you for another code.
But could they not have asked me for the second-factor code when they displayed the fake pages? Here’s the problem for them: they have no way of knowing in advance if you have two-factor authentication enabled on your account or not.
Finally, when they attempt to log in using your (scammed) password, you’ll get an email immediately from Google, which looks like this:
You’ve probably seen this email often – but don’t ignore it!
You will know immediately that something is wrong, since this was not you. Once you know this, you can – and should – change your password right away.
(You’d get this email even if you did not have 2FA setup, but by that time it’d be too late, since the attacker would have logged in to your account).
Protecting from really malicious attackers
But what if the scammer was someone who knew you, who is targeting you specifically, who knew – somehow – that you have two-factor turned on, and custom-built a two-factor flow to phish you? A couple of things:
One, your two-factor code is only valid for 30-second intervals. Subtract from that the time it takes for you to look at the code, memorize it, switch back to the login screen, type it (or, if you copied it, then paste it), and tap next. The attacker now needs to copy that code from their malicious code into the Google login screen they’re using to get into your account within whatever few seconds are left. It’s not impossible, but it’s really hard, and even harder to get right in the one shot that they have.
(And it’s not like the 30 second countdown starts when you open the Authy app. Try it – you could well open the app midway through a 30-second cycle, so the time the attacker has is even less).
Two, when you log in with your two factor code on any browser, select the ‘Don’t ask again on this computer’ box on the two-factor screen:
Why would you want to tell the browser to bypass the second factor? Because access to your browser is safe – since it’s on your password-protected phone or computer – and now you can distinguish between a trusted and an untrusted page. How?
Let’s go back to the truly malicious attacker, who has found out beforehand – somehow – that you have set up two-factor authentication, and has created a fake Google-like flow that asked you for your second-factor code. You are fooled by the genuine-looking email, and you click on the link. Your browser opens. You are further fooled by the genuine-looking login page, so you enter your username and password. Now you see a genuine-looking second-factor page.
At this point, you should immediately be suspicious – you’ve explicitly specified to this browser that you don’t want Google to ask you for a second factor code. That should tell you it’s not a genuine web page, and you can pause and check the email and the login page are genuine.
Links to set up two-factor authentication for Instagram, Facebook and other social media
Authy has helpful guides with steps and screenshots for setting up 2FA for many common services. Everything above on how 2FA protects your Gmail account is applicable for all the services below.
If you own an iPhone, Mac or iPad, you should also turn on two-factor authentication for your Apple iCloud account using these instructions. The only difference is that you don’t need to use Authy. Apple will send the second-factor code to one of your devices as a notification.
Remember
In each case, choose to use an ‘authentication app’ over using ‘SMS’. Add the account to Authy in the same way as in the Gmail example above.
In each case, save any recovery codes that are displayed on screen. In the rare case that you are locked out of your Authy account AND need to use your second factor for one of your accounts, you can use one of these recovery codes to log in.
So. I hope this gives you a good idea of not just the what, but also the why and how of protecting your accounts with two factor authentication.
If more of us do this, and spread the word, we can defeat phishers and scammers – something unimaginable today.
Appendix: questions I usually get about two-factor authentication
Why not have my second factor sent to me over SMS?Why bother with a whole new app?
After all, this is how the “3D secure” protection works on credit card payments. Your credit card number and expiry are like your username, your CVV is your password, and then the SMS you receive from Visa or Mastercard or American Express or RuPay is your second factor.
The problem is that SMS as second factor is known to be insecure. Motivated attackers have been able to take control of your mobile number itself using a technique commonly known as SIM swap. After such an attack, your SMSes are now sent to their phone instead of yours. This 2020 CNET article describes this method:
Hackers have been able to trick carriers into porting a phone number to a new device in a move called a SIM swap. It could be as easy as knowing your phone number and the last four digits of your Social Security number, data that tends to get leaked from time to time from banks and large corporations. Once a hacker has redirected your phone number, they no longer need your physical phone in order to gain access to your 2FA codes.
Positive Technologies was able to hijack the text messages using its own research tool, which exploits weaknesses in the cellular network to intercept text messages in transit. Known as the SS7 network, that network is shared by every telecom to manage calls and texts between phone numbers. There are a number of known SS7 vulnerabilities, and while access to the SS7 network is theoretically restricted to telecom companies, hijacking services are frequently available on criminal marketplaces.
As of today, it’s unlikely that a casual attacker will resort to SIM swapping or an SS7 attack. But don’t discount malicious attackers – ex employees/teammates, a relationship that ended badly, a competitor, or someone who values access to your email/social media to get info about someone you know.
Why use two-factor codes instead of Google’s default notification system?
Google today pushes you to use its notification system as your second factor. This doesn’t require you to copy and paste time-sensitive six digits codes, ostensibly making your second factor login experience simpler. This is how it looks. After you enter your email and password, you see this screen:
If you open your Gmail app, it’ll open to this screen:
If you tap yes, your browser proceeds to your Gmail/Google Drive/whatever Google service you were logging into. This works across devices – you could be logging in on your laptop and tap Yes in the Gmail app on your phone.
Clearly there are advantages.
One, you’re not reading and re-typing six digit codes, so there’s no chance you’ll mis-type anything.
Two, it’s a single tap, so it’s much faster – there is no chance that the code will have expired by the time you paste it.
Three, the notification shows you the location of where the login is taking place. If your attacker isn’t in the same city as you, this is an immediate sign something is wrong. Same with the device. If you don’t own a Mac, and the notification shows that the login is taking place on one (like in the screenshot), you’re being phished.
Four, the 2-step verification screen lists the names of your device(s) that have Gmail installed. You can see that the text in the screenshot says “Google has sent a notification to your Rahul Gaitonde’s iPhone and Rahul’s 12.9” iPad Pro”. It’s almost impossible for an attacker to know this level of detail about you, so the fake two-factor screen that they present to you will almost certainly not name your devices.
So why should you use the Authy app instead of this seemingly elegant method?
One, everything we’ve seen above only applies to your Google account. To secure your Instagram, Facebook, Snapchat, Uber and other accounts, you’re going to need a code-based method anyway. Simplify your life. Use one solution instead of many.
Two, there is a real security downside.
Let’s revisit our walk-through of the phishing attempt. You’ve been fooled into clicking on a phishing email, fooled into entering your email and password on a phishing login page. In addition, your attacker, who is targeting you personally, has determined that you do have two-factor on, so they’ve created a page that resembles the 2-step verification screenshot above. As you enter your user name and password, they copy the password into an actual Google login screen, ready to get into your account.
Now, since you’re distracted, it’s likely you’ll fail to notice the location and device in the 2 factor notification in your Gmail app. After all, you haven’t noticed that the email – and these login screens – aren’t genuine. So. If you tap the notification (because you think you are in fact logging in), your attacker is in – instantly.
Contrast this to if you had pasted or typed your two-factor code. As we have seen above, it’s time-sensitive. And therefore
… your two-factor code is only valid for 30-second intervals. Subtract from that the time it takes for you to look at the code, memorize it, switch back to the login screen, type it (or, if you copied it, then paste it), and tap next. The attacker now needs to copy that code from their malicious code into the Google login screen they’re using to get into your account within whatever few seconds are left. It’s not impossible, but it’s really hard, and even harder to get right in the one shot that they have.
(And it’s not like the 30 second countdown starts when you open the Authy app. Try it – you could well open the app midway through a 30-second cycle, so the time the attacker has is even less).
In the case of the Gmail notification, the attacker doesn’t have to do any work. You tap the notification, they’re in. In this case, they have to read, copy, paste the code and tap Go within a tiny unit of time that they don’t know.
Why use Authy instead of the Google Authenticator app?
Google’s guides heavily promote their own Authenticator app over others like Authy. Even their code-based two-factor login screen refers only to the Google Authenticator app:
I’ll point you to Authy’s comparison guide, but here are the main bits: Google Authenticator is only available on mobile devices (not Macs or PCs), it can only be installed on one device at a time, it can’t restore from encrypted backups like Authy can.
The one-device limitation has caused problems in the past,. Due to a combination of factors, I was once forced to reach out to Google support to restore access to my account:
If I had been able to install Google Authenticator on my iPad or Mac, this wouldn’t have been an issue at all.
Disclosure: I own stock in Twilio, which owns Authy. I have no other relationship with Authy and received no compensation from Twilio/Authy for this article.
Last week, a friend of mine called me saying she had been locked out of her Whatsapp account on her phone, and someone else was logged in to Whatsapp as her.
My friend had received a message from one of her friends, saying that a code had mistakenly been sent to her number as an SMS, and could she please send it. Since the message came from a person my friend trusted, and in parallel, she had in fact received an SMS, she sent it.
Right away, she was logged out of her Whatsapp app.
My friend had been phished.
Phishing is an example of social engineering techniques used to deceive users.
Users are lured by communications purporting to be from trusted parties [such as friends]… typically carried out by email spoofing, instant messaging, and text messaging
My friend then told me that this attacker had then gotten control of friends’ and relatives’ accounts by simply repeating what the attacker had done with her.
The friend could not log right back into her account because Whatsapp imposes a limit on how frequently you can log into new phones. This is presumably to guard against situations like this, but the result was that the legitimate owner of the account had been locked out.
Eventually the attacker tried to get control of my account. This is the message I received from my friend’s Whatsapp:
And of course, in parallel, I had received a message from Whatsapp itself:
You can see how, if you’re in the middle of something, that you could distractedly copy and paste the OTP text – and lose control of your account before you knew what happened.
The attacker had simply entered my number into a Whatsapp login screen on a phone, triggering an OTP to my phone. Since they already had control of my friend’s account, they then messaged me as her, saying exactly what they had at the beginning of this post – that the OTP was meant for her but was sent to my number, could I please send it?
“So what? You can’t log into my bank from Whatsapp”
In a discussion about this later, someone had asked
“What do you get by hacking someone’s WA. It’s not like you can use the OTP for logging into bank accounts?”
Even if damage is not financial, it could be worse. A compromised Whatsapp account is a form of identity theft. This friend is in a leadership position. Whatsapp is a big part of their engagement – her team and key customers are all on Whatsapp. As are groups with parents, family, friends, professional groups.
My friend later wrote to me
The person who took over btw after a while went nuts…booted people out of my groups where I am admin, started writing gibberish and changed group names to angry faces etc
This is embarrassing, and it could have been a lot worse. Plus, after the fact, she had to do a form of contact tracing to find out who else had been phished via this compromised account, and if they had suffered any reputational damage.
How to protect yourself from such an attack
Turn on two-step verification. It’s under Whatsapp ➝ Settings ➝ Account
Do it now. Stop reading this article and do it, and then read on. It takes under one minute to setup.
To reduce the chances of you forgetting your six digit code, Whatsapp will occasionally ask you to enter it when you launch the app – not every time, but just enough that you stay familiar with what it is.
Here is why two-step verification (also called two-factor authentication) makes it all but certain you will never fall for a phishing attack:
When you set up Whatsapp on a new phone, or re-install it on the same phone, you now need to go through two verification steps. One, you enter an OTP that’s sent to your phone. And two, you enter this six-digit code.
An attacker who has phished your friend’s Whatsapp account may trigger an OTP for your number to your phone, and may message you asking for it. You may even be fooled into sending it to them. But Whatsapp will then ask for your six digit code. Now the attacker can’t pull the same trick saying they need a six digit code for their account – no, they have to explicitly ask you for your account’s six digit code.
Even if they’re posting as your friend, it is highly likely you’ll suspect something’s up.
So.
Do protect your Whatsapp account with two-factor authentication. Do get your parents, siblings and friends to set this up. Phishing is social engineering, and, like so many of our problems, has a social solution.
End note: What happens if you do forget your six digit two step verification code?
Well, Whatsapp will send login instructions to the email account that you provide when you set up two-step verification.
But what happens if the attacker first gets control of my email address? The verification code will be sent to an inbox that the attacker has access to.
Well. You protect your other accounts with two factor authentication as well. Especiallty your email address – for many, also their Google account. This is my guide on how to do that, without needing to remember several such six-digit two-factor codes:
The youtube-dl project is no longer available on Github. A crying shame. youtube-dl is used not just to pirate – it’s also to archive videos of protests & rights violations before they’re taken down – depiction of violence is a violation of YT’s TOS! 1/
Youtube-dl is a legitimate tool with a world of a lawful uses. Demanding its removal from Github is a disappointing and counterproductive move by the RIAA. https://t.co/VUbTokd4cP
It’s to archive videos of public events, which may have nothing to do with music. Even when they do have to do with music, as this artist says, youtube-dl was why he had a copy of his *own* performance: 2/
Just used youtube-dl the other day to download a livestreamed performance *of mine* posted by someone else (which I didn't have otherwise). RIAA does not represent musicians/creators, they're a mouthpiece for Warner and Universal and nothing else.
— @makamqore@mastodon.social 🦑🏳️🌈🎧 (@oudplayer93) October 24, 2020
I've used YouTube-DL to download lectures, free documentaries, debates and discussions, interviews, and NASA video footage. But because the program can be used to download music, it clearly should be taken down.
I use the tool occasionally to create a copy of rare versions of 50-year-old+ Hindi film songs that perhaps a few dozen people are interested in anymore, and which you won’t find on iTunes or any store. But they’ll be lost to the world if that YT account ever goes offline. 3/
youtube-dl will likely be down until the creators find an alternative repository, which will likely also be an RIAA target, very likely pushing it onto the Tor network, which’ll definitely get it labelled in the mainstream press as a piracy enabler – that‘ll be the narrative. 4/
More than anything, Github’ acquiescence sets a very worrying precedent. As this tweet says, cURL (& wget) are widely used open-source projects to download a wide variety of content. You could make the same case to shut these projects’ hosting down. 5/
Do I know anyone at @Github? This is bullshit. We’ve used youtube-dl before for a project archiving activist videos about BLM/police brutality.
This should be a loud wake-up call for the @mozilla Foundation, the Electronic Frontier Foundation , the Free Software Foundation – on their watch, a Microsoft business unit became the world’s most popular code hosting service, including for critical Internet projects 6/
The FSF had plans for its own code hosting service in Feb but it doesn’t look like they’ve reached a decision, much less begun execution. Sadly, paid, full-time teams will almost always execute *faster* than volunteer teams like in the FOSS world. 7/ https://libreplanet.org/wiki/FSF_2020
Censorship-resistance needs to be a top-level criterion for evaluation, for anyone who is building anything of value for the Internet. A strictly free (or open source) code hosting platform is of no use if it or its projects can be taken down just like with youtube-dl. 8/
This should be an equally strident wake-up call for other projects – such as @The_Pi_Hole, which I have written about so often, and which are hosted on github. If the RIAA has gotten its way, the much larger online advertising industry could very easily act next. 9/
There are so many other projects that survive publicly ONLY because they either fly under the radar or have not yet been targeted. Two that immediately come to mind are the Calibre project and its (independent) Kindle De-DRM plugin. 10/
Another thought that struck me after the thread is that a USA-centric industry association filed a notice under USA law to a USA-based company, Github/Microsoft, and knocked offline a project that
had contributors from all over the world
was forked by people all over the world
made a tool that was used by people from across the world
to download videos and knowledge created and posted by people from around the world
We think of the Internet as a shared resource. Practically, it is subject to the laws of just a few countries, especially the USA, and a few massive companies, also mostly registered in, and subject to the laws of, the USA. This is not a criticism of the country – such centralisation of authority and control in the hands of any one or few countries is detrimental to the future of the Internet as we know it.
I will probably have more to say about this, but this is it for this post.
