Loading post…
Fly.ioIncident / postmortem
Kurt Got Got
Summary
Fly.io recounts the takeover of its X/Twitter account after CEO Kurt Mackey entered credentials on members-x.com in response to a phishing email from alerts-x.com. The attackers revoked existing tokens, configured new 2FA, changed the account email, and used it for a crypto scam; the company says no customer systems or accounts were at risk, though the incident caused more than 15 hours of brand damage. Fly.io attributes the exposure to treating the shared social account as a legacy exception rather than protecting it through its normal Google IdP and phishing-resistant MFA. The post explains how FIDO2, U2F, and Passkeys prevent fake sites from receiving real credentials, while noting that the 1Password browser plugin could also have flagged the mismatched domain. The account is now protected with Passkeys.
Context
A shared legacy Twitter account sat outside Fly.io’s normal security boundary, with credentials available through 1Password. A phishing email exploited uncertainty around developer memes and directed Kurt Mackey to the lookalike members-x.com domain, leading to an account takeover.
Approach / What changed
Fly.io audited access to the account credentials, revoked access for people who had recently retrieved them, reset the password, and worked with X.com to recover the account after the attackers added their own 2FA. The company then moved Twitter access to Passkeys and uses the incident to explain phishing-resistant authentication through FIDO2, U2F, and an IdP.
Takeaways
The phishing email used alerts-x.com and members-x.com to imitate X.com; the 1Password browser plugin could have identified the host mismatch.
FIDO2, U2F, and Passkeys use origin- or channel-bound authentication so a fake site cannot receive the real credentials.
The attackers revoked tokens and added new 2FA, leaving Fly.io unable to immediately lock them out even after resetting the password; X.com recovery took about 15 hours.
Source and freshness
- Source
- fly.io
- Published
- Added to Yomu
- Last updated
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.