15 ms·
Twitter Still Can't Keep Up with Its Flood of Junk Accounts, Study Finds
- aboutruby 8y agoSeems like most spammers / scammers are finding out passwords of old accounts instead of creating new ones (which are a pain to create due to the phone number verification and the disposable phone numbers ban). Twitter should probably scan their user passwords for obvious / most-used ones and require their users to change their passwords.
- overcast 8y agoAssuming they aren't using plain text, or simple hashes, how would Twitter do that? Even a standard salted password against that many accounts is tens of millions of cpu hours. Using something like bcrypt would be 10,000x slower than that!
- michaelbuckbee 8y agoHonestly, the easiest thing to do would be to force a password change on any user that hadn't logged in in X months.
- darkmarmot 8y agoSince they have the salts, they could just take a common passwords list, generate the hashes associated with all of them, then force any users with matching hashes to change their passwords.
- overcast 8y agoYou're misunderstanding how this would work. This is effectively what a hacker would do brute force. You have to generate a hash for each password in your common list, for EACH salt in your user list. 326 million Twitter users x each password in your list. Really comes down to which hashing function they chose, and how fast it does that calculation. Something like bcrypt is roughly 100ms per hash, which is a LONG time when you're crunching billions of them.
- llukas 8y agoFor 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. There is no excuse not to do it, especially you need to do it only once per user (until password change).
- giancarlostoro 8y agoAs somebody else commented, a quicker solution is to just force a password reset based on number of months since last login. If you havent logged in for over a year is a good rule of thumb.
- overcast 8y agoRight, but I was replying to OP. "Twitter should probably scan their user passwords for obvious / most-used ones and require their users to change their passwords."
- kgermino 8y ago>For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. That's 90 hours per account, multiply that by 326 million accounts and it's over a billion CPU days. You can reduce it a lot (no need to spend time calculating the password for users who log in regularly, just wait for them to give it to you) but it's still a massive scale. Especially since the biggest risk comes from the millions of rarely used accounts.
- llukas 8y agoCorrect. Forgot to multiply by 10^6
- justsomedood 8y agoI'm getting 90 million hours of single threaded execution time for 326 million users with 10k passwords each, and 100ms per hash.
- dasil003 8y ago
- deleted 8y ago[deleted]
- aboutruby 8y agoI mean, the account stealers can do it, and not Twitter itself? Which one has the most ressources?
- sigfubar 8y agoForce every single user to change their password right now. When a new password is entered, check it against common passwords, and reject bad inputs as needed.
- ElijahLynn 8y agoThis would cause friction and they would lose users, which would piss off investors. This isn't a technical issue.
- sigfubar 8y agoConsidering the degree to which most Twitter users are trash, I wouldn't mind losing a few of those. The rest will understand the need for security.
- penagwin 8y agoYeah but you're not an investor. Twitters been struggling to make money for a long time, do you think the investors would be happy to see a decline in active users because of "security" - a concept they barely understand?
- sigfubar 8y agoI’m not an investor in Twitter because I don’t invest in companies that are unable to assume an appropriate security posture. The same reasoning leads one to conclude that dilettantes who do hold Twitter stock deserve to get burned when poor security practices come home to roost.
- Zecar 8y agoTwitter has a perverse incentive to allow them because it is directly related to their stock price
- SlowRobotAhead 8y agoRight. It comes down to “can’t” or “won’t”. It makes little sense imo for Twitter for demolish their user stats. The last big round of fake bot purges saw significant percentages of users removed from prominent accounts like Obama’s. If normal people don’t know it’s a problem - why would Twitter want to fix it? Add that to a real financial hit if they do. Not “can’t”, “won’t”.
- ElijahLynn 8y agoExactly, this is a non-technical issue.
- jonathankoren 8y agoYes, but only up to a point. DAU and MAU is a reflection of advertising audience size, and thus potential revenue. If company A has. 1M DAU, and The grows it in 2M in a year, that’s good growth, revenue should double even with everything staying the same. It’s stock price should at least double, probably more than that to price in future growth. Compare that to Company B that has 500k DAU and flat. Not so good. Now what happens if it turns out that Company A’s DAUs we’re actually bots? Suddenly, the audience isn’t worth anything, because bots aren’t an advertiser friendly audience. So now the stock should at least drop in accordance to the real-DAU, and maybe even less to price in lack of confidence in the future.
- chalst 8y agoFinancial analysts should really look at the make-up of accounts.
- YjSe2GMQ 8y agoThis is humiliating to Twitter. The fact that someone can create a better spam filter without having access to corporate private information (such as user interaction signals, which are normally incredibly powerful) points to that they simply don't want to kill the spam: > In fact, the paper's two researchers write that with a machine learning approach they developed themselves, they could identify abusive accounts in far greater volumes and faster than Twitter does—often flagging the accounts months before Twitter spotted and banned them.
- Amezarak 8y agoTwitter's existing spam filter also evidently has a lot of false positives. I created an account many years ago and used it pretty much just to browse around Twitter, follow people, etc., without posting anything. I dropped off for a couple years and when I came back my location had been changed to Russia (???) and the account was suspended. I saw no evidence that the account had been hacked or anything - there was no activity that I wasn't responsible for. My appeal was denied without explanation. I can only assume I was wrapped up in some anti-spam measure. EDIT: To address responses to this, I think it's extremely unlikely the account was hacked. To be clear, there was no account activity of any kind other than the location change. The password was long, complex, and one I did not use anywhere else.
- seanmcdirmid 8y agoHow is having your location set to Russia not evidence of a hack?
- higginsc 8y agoYeah, that's a pretty strong signal that your account got used for some nefarious shit.
- Amezarak 8y agoThere was literally no account activity other than this. What 'nefarious shit' could it have been used for, given there were no tweets, likes, retweets, follows, DMs, or anything of that nature? EDIT: I should also add that I have a very strong password which is not reused anywhere, so I doubt very much someone guessed the password.
- rthomas6 8y agoTime for everyone to move to the Fediverse! Preferably small instances for your irl social circle. I know it probably won't happen that easily, but a man can dream.
- neurotrace 8y agoI tried it out for about a month. In principle, I think it's a great idea. In practice, no one in my IRL circle is interested in using it when we can just message each other. The lack of use and discoverability means it's difficult to meet new people on it. At least that was my experience.
- thosakwe 8y agoHot take: the Fediverse won’t catch on unless it gets a killer app of its own. Every federated project I’ve seen is a clone of something else.
- riffic 8y agoThe killer app will be when journalists, public institutions, and community orgs are contributing content to the fediverse on instances run by their employers.
- gevi99 8y agoThose are the last sections of society that usually adopt new tech though.
- rthomas6 8y agoI think it may take off when blogs offer activitypub streams and you can follow them and it shows up in your feed. The technology is already there, people just have to add it.
- snr 8y agoThe authors conveniently forget to mention the false positive rate with their approach.
- rchaud 8y agoWhat is Twitter other than a way for celebrities and consumer brands to advertise to their customers? I suppose with paid-for follows and retweets from click farms, you can position yourself as an 'influencer' and get a gig pitching slim tea, or testosterone gel or something out of a late night TV infomercial. The whole thing feels highly commercialized and yet, at the same time, very gauche, like stepping into a neighbourhood where the only stores sell payday loans, bail bonds and liquor. I follow ~12-15 people in my industry who are knowledgeable about stuff, but honestly, that makes Twitter extremely boring. I'm starting to realize that the drama and beefs (often manufactured) is what keeps ordinary people coming to a medium where they aren't even the intended customer.
- samlevine 8y agoI use it to follow and post news, as well as what academics are interested in posting/sharing. Microblogging is great, and Twitter remains the least worst solution for this.
- abdullahkhalids 8y agoI use twitter to follow people (usually scientists or public intellectuals) that tweet solid ideas or share essays with solid ideas. I only follow accounts with high signal to noise ratio. Noise is empty tweets that have no substance or buzzfeed like articles. Here is a prime example of an account and tweet that has lots of substance https://twitter.com/michael_nielsen/status/1061824470556467200 https://twitter.com/michael_nielsen/status/10618244705564672... He also has lists of accounts on his profile that have high signal to noise ratio. https://twitter.com/michael_nielsen/status/1081070044648398848 https://twitter.com/michael_nielsen/status/10810700446483988... Personally I would love to have the feature of following accounts for their self-written tweets but not retweets. Definitely will help with signal to noise. But that goes against Twitter's business model, so I doubt it will happen.
- ElijahLynn 8y agoI think that Twitter could but they care more about growth and err on the side of caution and less aggressive account validation, otherwise the new account sign ups would flatline and investors would be pissed. Capitalism.
- AJ007 8y agoThe only spam in my Twitter feed is “people you follow also follow.” I’ve been doing a lot of blocking.
- jpalomaki 8y ago”One drawback to the Iowa researchers' method was its rate of false positives: They admit that about six percent of the apps their detection method flags as malicious are in fact benign. But they argue that false positive rate is low enough that Twitter could assign human staffers to review their algorithm's results and catch mistakes. ” If I understand right, out of 460k apps 170k were malicious. That should lead to quite many manual reviews, if you don’t trust the algorithm. Also I’m not sure if this would a task where humans are any better. At these numbers 6% is quite much in absolute terms. That would mean quite many legitimate apps getting blocked (unless I’m missing something here).
- jonathankoren 8y agoIt’s simply not worth the time and money to pay someone to review every app created everywhere. Even with a 6% false positive rate, those app developers will appeal if it’s worthwhile (which will probably be less than the full 6%), and then they can be manually reviewed, and the false positive rate brought down after some more iterations. 6% is 6%. The absolute number is meaningless. It’s just a crappy twitter integration that no one really cares about. It’s not a human life.
- ChrisLTD 8y agoTwitter should charge ~$1 for every new account. Since Twitter is no longer a growing product, they are way past the stage where a nominal charge for new accounts would hurt their KPIs.
- chiefalchemist 8y agoI just moved and in order to file a change of address via the USPS website I was able to give them a credit card and was charged a buck or two as some sort of identity verification process. To your point, certainly reasonable must be available to Twitter, __if__ they were truly interested in cleaning up their act.
- salimmadjd 8y agoGeoff Goldberg (@geoffgolberg) [1] who is very vocal about this on twitter and has done bunch of analysis about foreign bots, got his account suspended by foreign trolls flagging him. Presidential Candidate, Kamala Harris (@KamalaHarris) account was inflated by millions of fake followers. There is an analysis of it here [2] Which is if paid by the campaign, by law it should be reflected on their campaign spending (however, it would violated twitter's rules and her account could be suspended). Or paid by some PAC. Either way, if it's so easy to detect, it's obvious twitter knows about these and are just not reacting to them and only removing some accounts for PR purposes. [1] https://twitter.com/geoffgolberg https://twitter.com/geoffgolberg [2] https://twitter.com/likingonline/status/1092643779402620928 https://twitter.com/likingonline/status/1092643779402620928
- ceejayoz 8y agoDon't discount the alternative possibility of an opponent buying followers. Someone pulled that on Roy Moore: https://www.nytimes.com/2018/12/19/us/alabama-senate-roy-jones-russia.html https://www.nytimes.com/2018/12/19/us/alabama-senate-roy-jon... > It involved a scheme to link the Moore campaign to thousands of Russian accounts that suddenly began following the Republican candidate on Twitter, a development that drew national media attention. > “We orchestrated an elaborate ‘false flag’ operation that planted the idea that the Moore campaign was amplified on social media by a Russian botnet,” the report says. It's fairly common with Google AdSense, too - generate obvious click fraud on a competitor's ads, watch them get suspended.
- stingraycharles 8y agoThis seems really difficult a problem to tackle for Google, Twitter etc. Other than a victim trying to make a strong case that they are not responsible, are there any elegant solutions to this problem?
- Barrin92 8y agowhy not tie twitter accounts to some strong real world identification? One cent payment to twitter, national id or something of that sort? Just push the bar up for people. The flipside is that people who want to stay anonymous or people with privacy concerns will stay off the platform, but I think fundamentally there is a price to be paid if you want an authentic community.
- gjsman-1000 8y agoDisable the API.
- Implicated 8y agoThat wouldn't stop them.
- GaryNumanVevo 8y agoHere's an honest question: Why not just let Twitter users pay to get more followers? The effect is two-fold. You're removing the grey market of fake bots for padding follower numbers, and also make a paper trail for accounts
- shanth 8y agoThat's Justin sun in action.
- chiefalchemist 8y agoCan't keep up? Or doesn't really want to keep up? Not a month goes by where there's not a HN post on this subject (or very similar). If they're making a profit then there is - at least at this point in time - not enough incentive for them to change. The KPI we need to know is: As bot accounts increase what is the churn of real accounts? Unless real accounts are falling, and it's because of bots / spam, then Twitter is unlikely to do much about the problem; because to them it's not really a problem.
- trumped 8y agoThere's a bit of "can't" and a bit of "don't want to"... they just make more money this way.
- mtnGoat 8y agoMaybe they don't want to fix the problem? Keeps numbers inflated for quarterly reporting. Same reason why facebook hasn't closed a few of their holes, black hat ad dollars keep the investors happy.