This story truly terrifies me: my team owns my company's sign up page. (I speak for myself and not them, of course).
Sounds like Parler, fearing that their OTP provider might go down, decided to fail-open, ie: if the dependency throws an exception, presume there's something wrong with the dependency and that the code provided is acceptable. It never occurred to them that the dependency could be down permanently, or that malicious actors[0] would be able to realize it and exploit to quickly.
Lesson learned: do not fail open where security matters, where authentication matters. Failing closed prevents new users/customers from signing up, but it protects your existing users/customers.
[0]From a security standpoint, these are malicious actors. I would also probably buy said malicious actors a beer if I met them, accompanied by a high five.
Edit: this is a hypothesis of course. Maybe the bug was somewhere else in the system- it could be in Twilio's provided integration library where the fail-open occurred.
Sounds like Parler, fearing that their OTP provider might go down, decided to fail-open, ie: if the dependency throws an exception, presume there's something wrong with the dependency and that the code provided is acceptable. It never occurred to them that the dependency could be down permanently, or that malicious actors[0] would be able to realize it and exploit to quickly.
Lesson learned: do not fail open where security matters, where authentication matters. Failing closed prevents new users/customers from signing up, but it protects your existing users/customers.
[0]From a security standpoint, these are malicious actors. I would also probably buy said malicious actors a beer if I met them, accompanied by a high five.
Edit: this is a hypothesis of course. Maybe the bug was somewhere else in the system- it could be in Twilio's provided integration library where the fail-open occurred.