zlacker

>>colone+(OP)
I wonder where the "50M users" estimate comes from. It seems like the feature that caused it, "View As", is probably available to more than that many people. Does this mean that they managed to trace the attacker capturing the access tokens of 50M users? Even allowing for the bug in the first place, it seems like exploiting it should be detected before 50M uses.

>>losved+y2
Probably they have stats on how many people actually used the feature.

>>moltar+Q2
Most likely this. I have a few dev accounts, one which I know I used the feature at some point, another few which did not and those were not reset.