11 ms·
Why I published Venmo users’ “drug” deals on Twitter
- _bxg1 8y agohttp://www.vicemo.com http://www.vicemo.com
- Dirlewanger 8y agoWelp, so much for the Medium article author deleting his version when this one exists...
- swozey 8y agoMeh, I'd wager 80-90% of these are kids/friends joking around. I've definitely gotten "Thanks for the great night" sort of stuff from mates before when I remind them I bought lunch a week ago. Still don't understand why people ever use the Public setting on Venmo, but that's another story. It's practically the opposite of Instagram, instead of looking like some rich socialite to your crew you look like someone who doesn't carry enough money for takeout.
- yoz-y 8y agoIf reading "So you have been publicly shamed" has taught me one thing. It is that an unfortunate Tweet without substance can turn into a career ending horror story quite quickly. Yes the data is publicly available, but there are less reckless ways to raise awareness.
- dharmab 8y agoThe author did not include names in their tweets, only the message (memo/comment) field of each transaction.
- yoz-y 8y agoFrom the article: "I removed the last names of users because..." and from the TNW critique of the bot "... in the form of a bot that tweets the names and faces of Venmo users...". I assumed that the available information was first name, avatar picture and the "drug deal". From the sample tweets it looks like first name and the first letter of the last name were given, but no avatars.
- syndev 8y agoOn the other hand, stopping yourself because of fears of imagined rebuke removes you from changing the status quo at all.
- kop316 8y agoA previous discussion on Venmo and publically available data form it (People using Venmo to spy on cheating spouses): https://news.ycombinator.com/item?id=17181130 https://news.ycombinator.com/item?id=17181130
- lykr0n 8y agoThis is one of those things that the people who welcome the march towards crypto or cashless seem to forget, ignore, or don't consider important. Privacy of what you do with your money is important. I know Vemmo is an extreme example, but it's not like they don't still have that data accessible for interested parties to access. People here like to say "We're never going to give customer data over blah blah blah," but time changes everything. The information is there, and you don't know what the laws or social forces will bring tomorrow. Either way, a good spotlight on the issues that need to be discussed.
- Franciscouzo 8y agoThe majority of cryptocurrencies might forgo privacy, but there are projects such as monero (and other cryptonote cryptocurrencies) which have privacy as a first class citizen.
- blattimwind 8y agoMonero's obfuscation doesn't really work as well as the developer thought it did.
- Franciscouzo 8y agoDo you have a source or paper on the vulnerabilities you're mentioning?
- blattimwind 8y agoLMGTFY "monero privacy" https://www.cryptoglobe.com/latest/2018/03/mit-finds-monero-transactions-not-as-private-as-previously-thought/ https://www.cryptoglobe.com/latest/2018/03/mit-finds-monero-...
- Franciscouzo 8y ago> Although these two weaknesses have been known to Monero’s developers since 2015, it was not until February 2017, when Monero’s implementation was modified, that these concerns were addressed, thus making post hoc de-anonymization more difficult. According to the researchers, transactions prior to this date are at significant risk of being identified.
- cphoover 8y agoTo me this brings into discussion the distinction between legal privacy and ethical privacy. If I'm walking down the street and tell my SO something in confidence (perhaps a medical diagnosis), and you are walking behind me and overhear, legally it's your right to spread what you hear to anyone you want. Ethically... it would be wrong to do so. I do think people view online privacy through that same lens... We have community bubbles, that are technically public, but we feel confident speaking within them for whatever reason. Yes people need to be more conscious of where communication take place, but it does not excuse unethical, legal, abuse of privacy.
- yifanl 8y agoCommunications on the internet are different than physical communications. So different in my view as to not really have a useful comparison point. If I tell a joke, people will chuckle and it'll be on their mind for 10 seconds, and then it's gone. All I need to do to make sure no one is overhearing it is to do a quick look over my shoulder. And if someone does leak it, I'll know which 6 people it might be and I can confront them. If I write that same joke down online, it's there forever, anyone can grab the joke any amount of time later, strip out all surrounding context, report me and have me fired from my director gig. Our social systems were developed with the understanding that communications would persist for a minute at most. This does not translate well to online systems.
- rexpop 8y agoOur social systems will adapt; James Gunn will survive, but also his and similar examples may impose a chilling effect on discompassionate writing.
- discompassion 8y agoIt's basically a fact now, that anything you say in any text messaging service to anyone, no matter how encrypted or protected the service may claim to be, if you say something interesting, your friend is likely to capture the screen contents to an image, and publish it somewhere to get laughs. There's no stopping this fact, and with daily zero day fire drills, the defense of claiming an insecure, hacked smartphone is at fault, is essentially plausible. But it gets worse, because hacking isn't a even required step. One sketchy app installed on a phone with zero defects is enough to plausibly deny a sceenshot of a private conversation escaping into the wild. People breeze past those permissions authorizations all the time. But of course installing promiscuous app isn't even a required step, because some phones have stock apps installed at the factory, and are insecure out of the box. Or, hey, maybe they bought their phone second-hand, because phones can cost $1000 now, so knocking a hundred bucks off the sticker price isn't even unconscionable, and less technical users are clueless as ever, so they wouldn't even consider the risks. So, no matter what, at the consumer level, truly no one is in control of how things leak, even if you choose your friends wisely. An Apple engineer can't even let his daughter look at a prototype over lunch without her accidentally instagramming the world in a moment of irrevocable error. So, chilling effects? I mean, without question, when being deaf and mute to the point that one may as well be bound and gagged is the only cure, calling that "chilling effects" is quite the understatement. We are moving rapidly toward a society that only thinks "happy" thoughts, for fear of the consequences oherwise. Is such a fear healthy?
- nimbius 8y agoAs an american, this is one of the most sadistic and reckless ways to raise awareness of a security issue and the researcher should be ashamed. - American drug laws carry some of the harshest penalties in the developed world. Civil forfeiture allows police to seize your car and home, without trial, for drug charges. 3 strikes laws can and have put many people in prison for sentences as long as 20 years, for less than an ounce of Marijuana - once released from prison, many American ex-cons are required to pay restitution for their incarceration and can be legally discriminated against for housing, employment, and even public benefits in some states. reformed convicts cannot vote in most american states, and must file legal petition for restoration of their right to vote. - parole terms can be extended well beyond a prisoners sentence and require years of monitoring and testing services the former convict must pay for, or be sent back to jail. simple convictions like marijuana can result in the loss of your children, the loss of your job, and complete financial ruin. Source: I have been incarcerated in the United States in the past.
- tpxl 8y ago>many American ex-cons are required to pay restitution for their incarceration Hold the phone, people get sent to prison then get to pay for that privilege once released? Do you have any further reading on that?
- hackermailman 8y agoSome states charge, for example prison health care, TDCJ/Texas will give you a bill upon release or skim your commissary account for payments. There's barely a state budget for prisons and voters don't want to pay for it, meaning political suicide if you're giving tax dollars to convicts.
- SketchySeaBeast 8y ago> There's barely a state budget for prisons and voters don't want to pay for it But boy do they love watching people get locked up. What a bad approach for treating the ills of society. Let's lock people up at the drop of the hat, make it the most miserable thing possible, and then expect them to come out well adjusted and fully functional. People went to jail because they were neither of those things before hand. But I guess as long as the prison system gets to turn a couple of bucks it makes it all worth it, right?
- deleted 8y ago[deleted]
- draw_down 8y agoIts a pretty well-trod path by now, isn’t it? Find some API emitting data people wouldn’t necessarily want to see on a web page, write a few lines of code and buy a domain name for it. There’s probably even a HTML/CSS template for it
- nxc18 8y agoEven on cash I rarely put the real purpose in the memo field... Coming from cash, and finding that the world has apparently settled on venmo, has me supremely disappointed. What the hell were they thinking? Payments is not a social network. I hope venmo feels blowback for this, but I know they won't. Can any venmo engineers comment on their ridiculous system? Do any users actually find value in sharing their drug deals (and other transactions) with the public?
- JumpCrisscross 8y ago> the world has apparently settled on venmo My New York circles are on Apple Pay and Zelle. I just refuse to accept Venmo, by virtue of them being a PayPal company.
- wuliwong 8y agoCan you pay your friends through apple pay?
- mikestew 8y agoYou can now, assuming that (duh) your friends have Apple Pay. I have yet to use it, so I cannot speak to the experience.
- deleted 8y ago[deleted]
- djrogers 8y agoYes, it's called Apple Pay Cash. You can send and receive cash through iMessage, and it gets put on a virtual debit card you can trasfer the $ out of to your bank account, or spend via Apple Pay at a store or via Apple Pay Cash. IMHO it's better and faster than Venmo, PayPal, or any other ones I've tried. Having the money on a virtual debit card you can spend anywhere tha accepts Apple Pay is really nice, and the bank transfers are very quick.
- 8y ago
- codezero 8y agoThe public stream is so old that I assume people put drug emoji in there as an over joke.
- deleted 8y ago[deleted]
- foobarbecue 8y agoThere's been a website for months or years that does this, right?
- togg719 8y agohttp://www.vicemo.com/ http://www.vicemo.com/
- foobarbecue 8y agoRight... and it's still live... so why does anyone care about this guy's Twitter bot?
- chillingeffect 8y agoThe system reports deals containing "stripper." Which launches it straight into moral territory. It also has many, many false positives, e.g. "pills" are legitimate means of taking medication. And "Drank"? Is it likely this many people are mixing together cold syrup and grape juice or is it the past-tense of drink. Also notice that "beer" and "wine" aren't flagged (unless appearing along other flags). This is absolutely emblematic of why we need our 4th amendment in the U.S. to prevent fishing expeditions. If governments were allowed to do this, they could ping things on many people who don't deserve it.
- trumped 8y agoIt's nice that Venmo makes the transactions freely available... banks make you pay for that information.
- habosa 8y agoI assume a lot of these are jokes. In fact my Venmo feed is basically reversed. If someone spots me $5 for lunch I'll likely pay them back for "Drugs" or "Illegal Activities" and if I'm actually doing something I would like to keep private I will say "Stuff" or "Thanks".
- paulie_a 8y agoI just write "legal things"
- corobo 8y agoThe rest of the thread has gone over the drugs aspect - I have to disagree entirely with > I actually don’t care for the term “bot” because it implies some sort of AI A bot is just a regular user account dedicated to and controlled by a non-human. Script, AI, IFTTT, whatever. It's a bot.
- blattimwind 8y agoSo, Venmo is basically a bank, but as-a-startup and it makes all your wires public by default? And people actually use this?
- seansmccullough 8y agoYep. That's like the only difference between it and PayPal.
- dgzl 8y ago> I learned that Venmo’s public by default setting made the details of millions of Venmo transactions publicly available to anyone who cared to look. So I did what any software engineer would do and started digging through the data. This makes me gag. Don't lump this behavior in with being a software engineer.
- 49531 8y agoDoes law enforcement actually look at Venmo as a source of evidence? I don't think I've ever put an actual reason for my transactions in the memo box. It's always something silly, and if you're actually buying drugs you're not going to say "this is for drugs" .
- wallflower 8y agoHonest question. If you were a hiring manager, would this post be a red flag for hiring the individual?
- swerveonem 8y agoThis guy should be careful, he might get got.
- onetimemanytime 8y ago>>By mid afternoon CNET, Mercury News and a half dozen other websites had posted articles about it. Not used to seeing my name on news websites, I cringed as I read expecting to get blasted — but I wasn’t. Until one of them that went to jail or lost their lively-hood and/or family decides to ask you, "what did I owe you, that you did that to me." Personally, I wouldn't do that for ethical and for the above mentioned reason...catching "drug users" is not my job.
- Mc_Big_G 8y agoAh yes, the totally factual and 100% accuracy of Venmo transactions. Like the $62 a co-worker with a dark sense of humor paid me for "cunnilingus".
- dkersten 8y agoWhy on earth would anybody ever want their transactions in a public feed anyway? I really don’t understand the attraction of it at all.