Hacker News Reader

Nice catch, this may be what it was.

Edit: looks like an admin panel was the culprit https://news.ycombinator.com/item?id=23853786

I don't understand this angle because typically admin panels only let you manage the account; deactivate, manage email address, etc. As shown in the screenshots.

Tweeting on behalf of another user seems like an unnecessary feature to give admins.

I've worked on products before that have a feature that lets an admin open the site using the user's session, which is useful for verifying issues that only present when logged in as the user.

To be fair though, this was not for a social network, and even if you broke into that account there wasn't much you could do beyond paying the user's bills.

Current consensus theory is attackers used the admin panel to change email address to an account they owned, then used that to trigger a password reset and gain control.

Early access wasn't supposed to be enabled until tomorrow. I wouldn't speculate until they give a post-mortem.

What timezone is "tomorrow"? Did this happen at midnight for some timezone?

Good point. I would guess that you are right, Anything over ~GMT+3 likely would have potentially been granted access.

Reply on news.ycombinator.com