10 ms·

As an american, this is one of the most sadistic and reckless ways to raise awareness of a security issue and the researcher should be ashamed. - American drug

As an american, this is one of the most sadistic and reckless ways to raise awareness of a security issue and the researcher should be ashamed. - American drug laws carry some of the harshest penalties in the developed world. Civil forfeiture allows police to seize your car and home, without trial, for drug charges. 3 strikes laws can and have put many people in prison for sentences as long as 20 years, for less than an ounce of Marijuana - once released from prison, many American ex-cons are required to pay restitution for their incarceration and can be legally discriminated against for housing, employment, and even public benefits in some states. reformed convicts cannot vote in most american states, and must file legal petition for restoration of their right to vote. - parole terms can be extended well beyond a prisoners sentence and require years of monitoring and testing services the former convict must pay for, or be sent back to jail. simple convictions like marijuana can result in the loss of your children, the loss of your job, and complete financial ruin. Source: I have been incarcerated in the United States in the past.

tpxl 8y ago
>many American ex-cons are required to pay restitution for their incarceration Hold the phone, people get sent to prison then get to pay for that privilege once released? Do you have any further reading on that?
- hackermailman 8y ago
  Some states charge, for example prison health care, TDCJ/Texas will give you a bill upon release or skim your commissary account for payments. There's barely a state budget for prisons and voters don't want to pay for it, meaning political suicide if you're giving tax dollars to convicts.
  - SketchySeaBeast 8y ago
    > There's barely a state budget for prisons and voters don't want to pay for it But boy do they love watching people get locked up. What a bad approach for treating the ills of society. Let's lock people up at the drop of the hat, make it the most miserable thing possible, and then expect them to come out well adjusted and fully functional. People went to jail because they were neither of those things before hand. But I guess as long as the prison system gets to turn a couple of bucks it makes it all worth it, right?
- danielvf 8y ago
  I did a little research. It's definitely not something I've ever heard of in my state. Looks likes this is mostly in Ohio? Apparently in the 1990's, almost all Ohio counties rolled this out. It's been being rolled back ever since. As of a few years ago, only 40 jails in the state charge these fees. Of these, the most expensive six jails charge between $50-$60 per night, 5 charge between $20-48, Some charge $1-$2 per night. $17 Ohio jails charge a booking fee only, usually $10 but up to $40. Some California cities have a pay-for-a-nicer prison scheme, but that's not really the same thing.
  - jessaustin 8y ago
    A few years ago when I was on jury duty, the primary business underway in the "County Justice Complex" seemed to be poor folks making payments on their jail stays. A real issue for some of them was making payments quickly enough to avoid additional jail stays, with the additional penury inherent in missing more work and having to pay more jail fees. This is in Missouri, a state more famed for its many injustices than Ohio is. We'd be safer and happier if we fired 75% of our LEOs tomorrow.
    - danielvf 8y ago
      Wow, Missouri's setup with this sounds awful! Unlike Ohio, which only has some mostly short stay jails that charge, Missouri charges statewide, and for prison, which averages six months to two years for an exiting inmate. Unbelievable! https://www.prisonlegalnews.org/news/2017/may/5/missouri-prisoners-vexed-bills-incarceration-costs/ https://www.prisonlegalnews.org/news/2017/may/5/missouri-pri... (As to firing LEO's, I think the research shows that there is a pretty clear correlation between more officers and less crime. So I'm not with you on that one.)
      - jessaustin 8y ago
        I haven't seen any of that research. Overall crime levels are correlated mostly with demographics. A good case has also been made that the prevalence of lead in childhood environments is a leading indicator of crime, but that is also a mostly demographic observation. Incidentally, if you're looking at violent crime at the state level to convince yourself that overpolicing is not a problem, you're missing out on the fact that St. Louis has the highest murder rate in the nation, and #13 in the world. https://en.wikipedia.org/wiki/List_of_cities_by_murder_rate https://en.wikipedia.org/wiki/List_of_cities_by_murder_rate
- twiton 8y ago
  Pay-to-stay: https://en.wikipedia.org/wiki/Pay-to-stay_(imprisonment) https://en.wikipedia.org/wiki/Pay-to-stay_(imprisonment)
TeMPOraL 8y ago
And were these things to happen to a Venmo user, it's ultimately Venmo that's responsible for it. (Also: this is work of a random dude that whipped up a Python script in 2 hours, after finding the API link on Twitter. Were the police to care about those tweets, wouldn't they care about those payments before?). I'm not sure if there is any other reasonable way of handling such problems. If I found this API link and saw this data, I should be able to report it to a government agency, and within a week, Venmo should be under threat of losing shit ton of money if they don't fix it (they should lose some over this anyway). Is there an official process that works like this? Why not?
- munchbunny 8y ago
  Yeah GDPR has provisions for that. In the US though? I don't think it's illegal if it's in the ToS or EULA.
- justin66 8y ago
  > (Also: this is work of a random dude that whipped up a Python script in 2 hours, after finding the API link on Twitter. Were the police to care about those tweets, wouldn't they care about those payments before?). Two things. First, you're seriously overestimating the technical acumen of "the police," on average. Second, there are all sorts of crimes that the police basically don't give a damn about but are more or less obligated to investigate if they're brought to the police's attention. You can see how zillions of people trolling one another's purchases online could lead to some tips to the police, etc. etc.
  - mikestew 8y ago
    Second, there are all sorts of crimes that the police basically don't give a damn about but are more or less obligated to investigate if they're brought to the police's attention. I'll counter you with anecdata: the Seattle Police Department and cannabis before it was legal in WA. They came right out and said, "it's at the bottom of our priority list." Oh, sure, they're probably still "obligated" to investigate, but writing parking tickets took priority that day, sorry. Just like the cops are in no real hurry to investigate my missing car stereo. They might be "obligated", but that doesn't mean other things aren't ahead in the queue.
sixstringtheory 8y ago
I agree. > I didn’t want to actually contribute to the problem of lack of privacy. This reads more like "I had a funny feeling this could be wrong, but I did it anyways for internet points." How could anything on the internet possibly go viral? I couldn't take what the author said very seriously after this.
- andrew_ 8y ago
  nice salacious hot take. knowing the author and having followed the development as it happened, I can attest to his sincerity. your assertion is just plain wrong.
  - sixstringtheory 8y ago
    So, an ad hominem followed by anecdata about someone with which you're personally invested? I think the fact they wrote that at all means it crossed their mind. Did they reach out to Venmo before publishing the article? I didn't see that mentioned anywhere. > I wanted to do something creative with this to demonstrate the lack of privacy in Venmo’s default settings. What was the goal of this? Maybe someone from Venmo would stumble across this, and start some meaningful dialogue around how... > to get a few laughs from my friends and colleagues Ah, right. And of course, posting this publicly on Twitter was the only way to do that? To me, this just shows contempt for users who may not even know that Venmo defaults to public, or even understand what that means. They became fodder for a cannon the author wanted to point at Venmo. Did the author contact all those users to inform them of the implications, both of their public transactions and the little piece of performance art they created?
madamelic 8y ago
>As an american, this is one of the most sadistic and reckless ways to raise awareness of a security issue and the researcher should be ashamed. As an American, you are under educated about how the justice system works. You can't be charged with crimes they can't prove. It's why comedians and public figures can openly admit to smoking weed. Putting a weed or needle emoji in your Venmo transaction isn't going to have the DEA breaking down your door in the next hour. These people are 100% completely safe. With all of that said, if someone is convicted due to this, they were already screwed and being actively monitored. Also the author said he removed PII.
- bagels 8y ago
  > You can't be charged with crimes they can't prove You certainly can be charged with any crime with or without evidence. And the way they make it stick is to offer a plea deal to avoid trial.
  - chillingeffect 8y ago
    charged and held in jail
    - pavel_lishin 8y ago
      Where do you think people go when they get arrested? And what do you think happens if they don't have money on-hand to pay bail?
  - ams6110 8y ago
    No, you cannot be charged literally without evidence. A judge would throw the case out, and likely censure or sanction the prosecutor. Can you be charged on weak evidence, or even in some cases fabricated evidence? Yes, but that's a different matter.
    - elif 8y ago
      You are describing a legal system that is written on paper. we have a real one. It's an easy mistake for programmers to make. We work in a world of provable absolutes that behave exactly as written.
dahdum 8y ago
This isn’t a security issue, Venmo is publishing this data by design. It’s already available for law enforcement, and they don’t need a Twitter bot. The bot was to inform the public. Shaming Venmo into protecting their users or just raising public awareness about their policies is a great start.
- 13of40 8y ago
  I think this is the right way to look at it. The twitter bot didn't give this information to law enforcement, because unless they're idiots they've been monitoring and archiving this from day one.
  - clkfkieienbe 8y ago
    You might be suprised.
    - deleted 8y ago
      [deleted]
    - testvox 8y ago
      I would be, this is exactly the use case for Palantir's social media monitoring system. If they failed to pull in this data source that would be a huge miss. Especially since Palantir and PayPal (who now owns venmo) were co-founded by the same person.
  - jpttsn 8y ago
    I doubt they’ve been monitoring and archiving this from day one.
- dgzl 8y ago
  The researcher isn't shaming Venmo, they're shaming the users.
- DyslexicAtheist 8y ago
  I agree that the data is already available, but to hurt the users without a second of hesitation? Much better and justified to go after the company, ... slowly step up the pressure and escalate it gradually until you have their attention. Tag their CxOs on LinkedIn, call them out in person (don't let them hide between a corporate facade) for their greedy negligence. Better would have been by publishing a paper about it imho ... But to hurt the user like this? The author is a flipping coward.
jchw 8y ago
Those tweets cannot be used to convict someone. It's also not really their fault given they just took existing public data and reposted it... But the final nail in the coffin is that simply put, 99% of the posts are from people who know it's public, don't care, and intentionally fill the description with stupidity. I can't count the number of times I've gotten venmo payments sent to me with salacious descriptions. If you're actually breaking the law you are probably fine because far more people are just screwing around and you'll blend right in. And also, if you are breaking the law and think it's a good idea to admit that repeatedly via internet payments, maybe you aren't the brightest.
- rch 8y ago
  A lot of people are naively breaking some law, but getting by because they are too obscure for anyone to get around to caring. Something like this with media coverage can effectively 'short list' a few unlucky people who wouldn't otherwise deserve scrutiny, thus making it irresponsible to do as a real researcher. Even fake salacious descriptions stop being fun when the IRS shows up for an audit.
- elif 8y ago
  Spoken like someone with no experience with drug court.
- daveFNbuck 8y ago
  > Those tweets cannot be used to convict someone. These tweets can't be used to convict you, but they could be used to secure a warrant and send a SWAT team into your house. Maybe they find drugs, maybe they shoot some people or pets, maybe they just scare everyone and damage your property. > 99% of the posts are from people who know it's public, don't care, and intentionally fill the description with stupidity How do you know that? My assumption was that payment details would not be publicly broadcast when I send money to a friend. Do you really think this assumption puts me in the bottom 1%?
  - mynameisvlad 8y ago
    > but they could be used to secure a warrant and send a SWAT team into your house Nobody is going to send a SWAT team to someone's house over a $25 Venmo transaction marked as "drugs". Not only is it not even close to nearly enough evidence for a warrant, but a SWAT team isn't going to get sent for drug possession in any case.
djrogers 8y ago
Wow, that's just about the most overwrought, overblown, and misinformed post I've seen here in a long time. 1) this information is already public - in fact he removed some of the identfying details (last name for example) 2) the twitter bot assumes the descriptions are jokes 3) none of this could be used to convict someone of a crime Unless you have some evidence that making public information like this public in a different format, calling someone sadistic for it is something should really be apologizing for. Your past incarceration does not give you any moral authority to be making personal attacks like calling someone sadistic...
JTbane 8y ago
I have to disagree- the data is out in the public by default (a feature of Venmo). Compiling such data is not abuse and is good for awareness.
qop 8y ago
What's wrong with any of this? People who are using and selling drugs are criminals like any other type of criminal. Civil forfeiture is fucked, sure, but the rest of the consequences sound pretty fair. Break the law, you pay the price. If you rob a small bank instead of Deutsche, should you get a smaller penalty? Just because it's a small quantity of drugs doesn't mean anything, it's still the same crime.
spraak 8y ago
> the researcher should be ashamed Nah, these people used blatant keywords in their public transactions. Even if you argue that they thought their transactions were private, these users chose to tag their payments with drug related keywords. If they really cared they would have encoded or obfuscated the payment descriptions.
newnewpdro 8y ago
Don't shoot the messenger. Your ire should be directed at Venmo. As an American, your comment is embarrassing.
y0ssar1an 8y ago
The people funding Mexican drug cartels are the ones who should be ashamed.
jhabdas 8y ago
Sorry to hear about your misfortunes. As more U.S. citizens abandon citizenship due to FATCA do feel the incarceration rate per capita will increase or decrease?

tpxl 8y ago

>many American ex-cons are required to pay restitution for their incarceration Hold the phone, people get sent to prison then get to pay for that privilege once released? Do you have any further reading on that?

hackermailman 8y ago
Some states charge, for example prison health care, TDCJ/Texas will give you a bill upon release or skim your commissary account for payments. There's barely a state budget for prisons and voters don't want to pay for it, meaning political suicide if you're giving tax dollars to convicts.
- SketchySeaBeast 8y ago
  > There's barely a state budget for prisons and voters don't want to pay for it But boy do they love watching people get locked up. What a bad approach for treating the ills of society. Let's lock people up at the drop of the hat, make it the most miserable thing possible, and then expect them to come out well adjusted and fully functional. People went to jail because they were neither of those things before hand. But I guess as long as the prison system gets to turn a couple of bucks it makes it all worth it, right?
danielvf 8y ago
I did a little research. It's definitely not something I've ever heard of in my state. Looks likes this is mostly in Ohio? Apparently in the 1990's, almost all Ohio counties rolled this out. It's been being rolled back ever since. As of a few years ago, only 40 jails in the state charge these fees. Of these, the most expensive six jails charge between $50-$60 per night, 5 charge between $20-48, Some charge $1-$2 per night. $17 Ohio jails charge a booking fee only, usually $10 but up to $40. Some California cities have a pay-for-a-nicer prison scheme, but that's not really the same thing.
- jessaustin 8y ago
  A few years ago when I was on jury duty, the primary business underway in the "County Justice Complex" seemed to be poor folks making payments on their jail stays. A real issue for some of them was making payments quickly enough to avoid additional jail stays, with the additional penury inherent in missing more work and having to pay more jail fees. This is in Missouri, a state more famed for its many injustices than Ohio is. We'd be safer and happier if we fired 75% of our LEOs tomorrow.
  - danielvf 8y ago
    Wow, Missouri's setup with this sounds awful! Unlike Ohio, which only has some mostly short stay jails that charge, Missouri charges statewide, and for prison, which averages six months to two years for an exiting inmate. Unbelievable! https://www.prisonlegalnews.org/news/2017/may/5/missouri-prisoners-vexed-bills-incarceration-costs/ https://www.prisonlegalnews.org/news/2017/may/5/missouri-pri... (As to firing LEO's, I think the research shows that there is a pretty clear correlation between more officers and less crime. So I'm not with you on that one.)
    - jessaustin 8y ago
      I haven't seen any of that research. Overall crime levels are correlated mostly with demographics. A good case has also been made that the prevalence of lead in childhood environments is a leading indicator of crime, but that is also a mostly demographic observation. Incidentally, if you're looking at violent crime at the state level to convince yourself that overpolicing is not a problem, you're missing out on the fact that St. Louis has the highest murder rate in the nation, and #13 in the world. https://en.wikipedia.org/wiki/List_of_cities_by_murder_rate https://en.wikipedia.org/wiki/List_of_cities_by_murder_rate
twiton 8y ago
Pay-to-stay: https://en.wikipedia.org/wiki/Pay-to-stay_(imprisonment) https://en.wikipedia.org/wiki/Pay-to-stay_(imprisonment)

TeMPOraL 8y ago

And were these things to happen to a Venmo user, it's ultimately Venmo that's responsible for it. (Also: this is work of a random dude that whipped up a Python script in 2 hours, after finding the API link on Twitter. Were the police to care about those tweets, wouldn't they care about those payments before?). I'm not sure if there is any other reasonable way of handling such problems. If I found this API link and saw this data, I should be able to report it to a government agency, and within a week, Venmo should be under threat of losing shit ton of money if they don't fix it (they should lose some over this anyway). Is there an official process that works like this? Why not?

munchbunny 8y ago
Yeah GDPR has provisions for that. In the US though? I don't think it's illegal if it's in the ToS or EULA.
justin66 8y ago
> (Also: this is work of a random dude that whipped up a Python script in 2 hours, after finding the API link on Twitter. Were the police to care about those tweets, wouldn't they care about those payments before?). Two things. First, you're seriously overestimating the technical acumen of "the police," on average. Second, there are all sorts of crimes that the police basically don't give a damn about but are more or less obligated to investigate if they're brought to the police's attention. You can see how zillions of people trolling one another's purchases online could lead to some tips to the police, etc. etc.
- mikestew 8y ago
  Second, there are all sorts of crimes that the police basically don't give a damn about but are more or less obligated to investigate if they're brought to the police's attention. I'll counter you with anecdata: the Seattle Police Department and cannabis before it was legal in WA. They came right out and said, "it's at the bottom of our priority list." Oh, sure, they're probably still "obligated" to investigate, but writing parking tickets took priority that day, sorry. Just like the cops are in no real hurry to investigate my missing car stereo. They might be "obligated", but that doesn't mean other things aren't ahead in the queue.

sixstringtheory 8y ago

I agree. > I didn’t want to actually contribute to the problem of lack of privacy. This reads more like "I had a funny feeling this could be wrong, but I did it anyways for internet points." How could anything on the internet possibly go viral? I couldn't take what the author said very seriously after this.

andrew_ 8y ago
nice salacious hot take. knowing the author and having followed the development as it happened, I can attest to his sincerity. your assertion is just plain wrong.
- sixstringtheory 8y ago
  So, an ad hominem followed by anecdata about someone with which you're personally invested? I think the fact they wrote that at all means it crossed their mind. Did they reach out to Venmo before publishing the article? I didn't see that mentioned anywhere. > I wanted to do something creative with this to demonstrate the lack of privacy in Venmo’s default settings. What was the goal of this? Maybe someone from Venmo would stumble across this, and start some meaningful dialogue around how... > to get a few laughs from my friends and colleagues Ah, right. And of course, posting this publicly on Twitter was the only way to do that? To me, this just shows contempt for users who may not even know that Venmo defaults to public, or even understand what that means. They became fodder for a cannon the author wanted to point at Venmo. Did the author contact all those users to inform them of the implications, both of their public transactions and the little piece of performance art they created?

madamelic 8y ago

>As an american, this is one of the most sadistic and reckless ways to raise awareness of a security issue and the researcher should be ashamed. As an American, you are under educated about how the justice system works. You can't be charged with crimes they can't prove. It's why comedians and public figures can openly admit to smoking weed. Putting a weed or needle emoji in your Venmo transaction isn't going to have the DEA breaking down your door in the next hour. These people are 100% completely safe. With all of that said, if someone is convicted due to this, they were already screwed and being actively monitored. Also the author said he removed PII.

bagels 8y ago
> You can't be charged with crimes they can't prove You certainly can be charged with any crime with or without evidence. And the way they make it stick is to offer a plea deal to avoid trial.
- chillingeffect 8y ago
  charged and held in jail
  - pavel_lishin 8y ago
    Where do you think people go when they get arrested? And what do you think happens if they don't have money on-hand to pay bail?
- ams6110 8y ago
  No, you cannot be charged literally without evidence. A judge would throw the case out, and likely censure or sanction the prosecutor. Can you be charged on weak evidence, or even in some cases fabricated evidence? Yes, but that's a different matter.
  - elif 8y ago
    You are describing a legal system that is written on paper. we have a real one. It's an easy mistake for programmers to make. We work in a world of provable absolutes that behave exactly as written.

dahdum 8y ago

This isn’t a security issue, Venmo is publishing this data by design. It’s already available for law enforcement, and they don’t need a Twitter bot. The bot was to inform the public. Shaming Venmo into protecting their users or just raising public awareness about their policies is a great start.

13of40 8y ago
I think this is the right way to look at it. The twitter bot didn't give this information to law enforcement, because unless they're idiots they've been monitoring and archiving this from day one.
- clkfkieienbe 8y ago
  You might be suprised.
  - deleted 8y ago
    [deleted]
  - testvox 8y ago
    I would be, this is exactly the use case for Palantir's social media monitoring system. If they failed to pull in this data source that would be a huge miss. Especially since Palantir and PayPal (who now owns venmo) were co-founded by the same person.
- jpttsn 8y ago
  I doubt they’ve been monitoring and archiving this from day one.
dgzl 8y ago
The researcher isn't shaming Venmo, they're shaming the users.
DyslexicAtheist 8y ago
I agree that the data is already available, but to hurt the users without a second of hesitation? Much better and justified to go after the company, ... slowly step up the pressure and escalate it gradually until you have their attention. Tag their CxOs on LinkedIn, call them out in person (don't let them hide between a corporate facade) for their greedy negligence. Better would have been by publishing a paper about it imho ... But to hurt the user like this? The author is a flipping coward.

jchw 8y ago

Those tweets cannot be used to convict someone. It's also not really their fault given they just took existing public data and reposted it... But the final nail in the coffin is that simply put, 99% of the posts are from people who know it's public, don't care, and intentionally fill the description with stupidity. I can't count the number of times I've gotten venmo payments sent to me with salacious descriptions. If you're actually breaking the law you are probably fine because far more people are just screwing around and you'll blend right in. And also, if you are breaking the law and think it's a good idea to admit that repeatedly via internet payments, maybe you aren't the brightest.

rch 8y ago
A lot of people are naively breaking some law, but getting by because they are too obscure for anyone to get around to caring. Something like this with media coverage can effectively 'short list' a few unlucky people who wouldn't otherwise deserve scrutiny, thus making it irresponsible to do as a real researcher. Even fake salacious descriptions stop being fun when the IRS shows up for an audit.
elif 8y ago
Spoken like someone with no experience with drug court.
daveFNbuck 8y ago
> Those tweets cannot be used to convict someone. These tweets can't be used to convict you, but they could be used to secure a warrant and send a SWAT team into your house. Maybe they find drugs, maybe they shoot some people or pets, maybe they just scare everyone and damage your property. > 99% of the posts are from people who know it's public, don't care, and intentionally fill the description with stupidity How do you know that? My assumption was that payment details would not be publicly broadcast when I send money to a friend. Do you really think this assumption puts me in the bottom 1%?
- mynameisvlad 8y ago
  > but they could be used to secure a warrant and send a SWAT team into your house Nobody is going to send a SWAT team to someone's house over a $25 Venmo transaction marked as "drugs". Not only is it not even close to nearly enough evidence for a warrant, but a SWAT team isn't going to get sent for drug possession in any case.

djrogers 8y ago

Wow, that's just about the most overwrought, overblown, and misinformed post I've seen here in a long time. 1) this information is already public - in fact he removed some of the identfying details (last name for example) 2) the twitter bot assumes the descriptions are jokes 3) none of this could be used to convict someone of a crime Unless you have some evidence that making public information like this public in a different format, calling someone sadistic for it is something should really be apologizing for. Your past incarceration does not give you any moral authority to be making personal attacks like calling someone sadistic...

JTbane 8y ago

I have to disagree- the data is out in the public by default (a feature of Venmo). Compiling such data is not abuse and is good for awareness.

qop 8y ago

What's wrong with any of this? People who are using and selling drugs are criminals like any other type of criminal. Civil forfeiture is fucked, sure, but the rest of the consequences sound pretty fair. Break the law, you pay the price. If you rob a small bank instead of Deutsche, should you get a smaller penalty? Just because it's a small quantity of drugs doesn't mean anything, it's still the same crime.

spraak 8y ago

> the researcher should be ashamed Nah, these people used blatant keywords in their public transactions. Even if you argue that they thought their transactions were private, these users chose to tag their payments with drug related keywords. If they really cared they would have encoded or obfuscated the payment descriptions.

newnewpdro 8y ago

Don't shoot the messenger. Your ire should be directed at Venmo. As an American, your comment is embarrassing.

y0ssar1an 8y ago

The people funding Mexican drug cartels are the ones who should be ashamed.

jhabdas 8y ago

Sorry to hear about your misfortunes. As more U.S. citizens abandon citizenship due to FATCA do feel the incarceration rate per capita will increase or decrease?