17 ms·

Personal information and ads on Twitter

464 points by coloneltcb 7y ago

6cd6beb 7y ago
I don't understand; isn't this literally the point of running a free service? Harvesting data and using it for marketing purposes?
- obenn 7y ago
  Yes but the user should in principle have some control over what data gets used for such purpose and what doesn't, it is their data.
- saagarjha 7y ago
  You don't have to do this.
- dave5104 7y ago
  In this case, Twitter was lying (or more generously, not being entirely truthful) with what they were using the data for. Some users may have chosen not to give up their phone number or email if they had known it would be used for advertising in addition to account security.
  - swiley 7y ago
    I just have a hard time imagining anyone wouldn’t expect that, maybe I’m getting paranoid though. I never gave facebook my number even though prompted for it literally every time I logged in.
    - Nextgrid 7y ago
      In fact, prompting every time is also a red flag. They wouldn't be so desperate if providing the number was for your benefit as they claim (for "security", etc). The real reason they're so desperate is because it's for their benefit.
  - icedchai 7y ago
    When signing up for a "free" service, I basically assume all data entered will be used for advertising / marketing purposes. This is a safe assumption to make.
    - dave5104 7y ago
      I don't disagree, but I think we should still be able to get upset when a free service uses the data for something other than what they said it would be used for.
    - TeMPOraL 7y ago
      It's why I love GDPR. Since it requires explicit, opt-in consent, I can just register or visit a site and don't worry much - abuse of my data is a bigger risk to the service than it is to me.
      - icedchai 7y ago
        Sounds good on paper. Reality is GDPR isn't going to stop an "error" from happening.
- steelframe 7y ago
  > Harvesting data and using it for marketing purposes? Twitter's actions make everyone less secure. The next time an online service asks me to enable 2FA to protect my account, I'll have to consider whether the potential for abuse of my 2nd factor information is worth the additional risk to my account.
  - tialaramex 7y ago
    FIDO tokens (for U2F or WebAuthn) don't give the relying party anything valuable. If they literally publish everyone's parameters it makes essentially no difference to anything. It doesn't even mean they stop being useful for authentication.
- musicale 7y ago
  The point of any service, free or otherwise, should be to deliver some kind of benefit to its users. If it doesn't do that, it has little reason to exist. "Data harvesting," marketing and advertising are far from the only business reasons why a company might want to offer a free service. From a business perspective, a free service might - build goodwill for the company - satisfy legal or government requirements - save money on billing while increasing the value of other goods and services from the company - enable the company to qualify for certain grants or subsidies - support the creation and improvement of goods or services (such as software) which the company uses - enable the company to influence industry standards - help to acquire future paying customers (e.g. by offering a free student or limited version which can be upgraded with additional paid features) - help to compete against other companies that charge for the same service - act as a loss leader to encourage sales of compatible companion products or accessories etc.
- Nextgrid 7y ago
  Not allowing opting out of data collection is actually in breach of the GDPR, so actually in the EU you can not run a business for the sole purpose of stealing data.
hayksaakian 7y ago
"When an advertiser uploaded their marketing list, we may have matched people on Twitter to their list based on the email or phone number the Twitter account holder provided for safety and security purposes. This was an error and we apologize." This doesn't happen accidentally, someone had to engineer, test and build a system that performed reliable targeting.
- alxmdev 7y ago
  Accidents happen all the time there though, like when they accidentally lock your new account minutes after you create it, and all but force you to give them your phone number in order to reinstate it.
  - sofaofthedamned 7y ago
    Same happened to me. However, I did do a support request which 2 days later agreed to let me in without a phone number. 2 days. I think we can file this under 'dark patterns' and finally realise Twitter is attempting to be as abusive as Facebook.
  - m463 7y ago
    A week or two ago anything I did with my hacker news account took me to google to solve a recaptcha. (I had blocked google when accessing this site, thanks umatrix) Or I could email them to unblock it (my account has no email address associated with it)
    - dang 7y ago
      Depending on what you mean by "a week or two ago", this was probably because of a botnet attack HN was under in mid-September, when we resorted to turning on recaptcha for logins for a while. We know why people hate this and want to avoid it in the future, but defending HN against attack took priority.
  - wpietri 7y ago
    I haven't worked there in a while, but you would not believe the volume of fake account creation they get. Spammers. Fraudsters. Jerks creating a second (or 20th) account to bypass restrictions. And more recently, state actors trying to manipulate things. So I am inclined to cut them some slack on the, "Please prove you're a real user" stuff.
jchw 7y ago
Didn’t this almost-exact same thing happen with Facebook? It’s funny how frequently these kinds of “accidents” happen. They seem to occur with the kinds of frequencies that you might hear a manager or developer say something like, “meh, what’s the worst that could happen?”
- throwaway_bad 7y ago
  I am still waiting for the same article to be written about google so they can fix their shit too. I got phone calls from google cloud platform even though I am certain I didn't give them my number. They even managed to find my real name even though the only place I used it was for the payment method in the billing account, with a fake name on the google account. This is way too much information to give to their internal sales reps.
  - bduerst 7y ago
    You don't need to. If you've ever filled out a form anywhere online to access an article, it's likely you opted in to having your data sold to broker agencies, who sell it for lead gen. The same goes for magazine subscriptions, credit card applications, even debt collectors, etc.
- mschuster91 7y ago
  > Didn’t this almost-exact same thing happen with Facebook? It’s funny how frequently these kinds of “accidents” happen. Assuming that accidents occur with a specific percentage of data collected, it's not "funny", it's explainable: the more data one has, the greater the chance of things going wrong because someone uses data that is there but should not be used for that purpose. That happens when systems grow so large that they cannot reasonably be understood by a single person.
- pwinnski 7y ago
  I think instead of "frequently," it happens "consistently." I mean, how many social media companies can we say have not abused these phone numbers?
- shkkmo 7y ago
throwaway_bad 7y ago
On twitter/fb, people can look up your account by phone number. This is really fucking stupid because I only added my phone number for two factor authentication. So now I have to choose between security or people finding my dumb throwaway accounts.
- spsful 7y ago
  You can disable this functionality in the privacy settings for Twitter-- not sure if Facebook allows it, though. Either way I totally agree that it's a dumb feature to have turned on by default.
- fireattack 7y ago
  It can be disabled (and at least in Twitter's case, I remembered it asked me if I want to enable it).
magicalhippo 7y ago
Raise hands everyone who's surprised by this... They say they inadvertently did it, which may be true. But if they have the data it can be abused. Goes for all those "omg think of the terrorists" data collection plans as well.
musicale 7y ago
At least Twitter is admitting that information collected for one purpose (two factor authentication, account recovery) should not be used for another unrelated purpose (advertising and use by "business partners.")
- t0astbread 7y ago
  "At least Twitter is admitting that they've heard of the concept of privacy"
sofaofthedamned 7y ago
" we have addressed the issue that allowed this to occur and are no longer using phone numbers or email addresses collected for safety or security purposes for advertising. " Does this mean the matches they've already made on these identifiers are still active?
- itronitron 7y ago
  Any advertiser that made the match previously will likely have that stored somewhere and will also probably have that identified with the twitter handle, so yeah those identifiers are still active, just not within Twitter.
jsnell 7y ago
Obviously writing an ads targeting system wasn't an accident. But why did it end up using data it wasn't supposed to? It seems unlikely that it was expressly written to work against data they weren't supposed to use for that purpose. It's much more likely that they had multiple data sources for email addresses and phone numbers, and had cross-contamination between the data sources. E.g. maybe they at some point had dozens of databases for user data, all maintained by different teams and grown organically. And then had a big effort to merge them into a single system with a rationally designed schema. And maybe they ended up coalescing all phone numbers of each user from all sources together, with some kind of annotations for why each phone number was collected. And then it's very easy for somebody to screw up the code that's supposed to filtering out security-only phone numbers when ingesting data into the ads targeting system. The above was totally theoretical scenario, but it should be easy to come up with lots of other ways for this to happen by mistake rather than intentionally. Don't think companies make these kinds of mistakes? Both Facebook and Google had issues with plaintext passwords this year. And it should be obvious that neither had anything to gain from that.
- sofaofthedamned 7y ago
  Bollocks. A phone number is an ideal identifier to match on, they've done exactly the same as FB - pretended it's something for security then gone 'oops'. I've never worked on the same scale as FB or Twitter and I know that this is a no-go area.
- opencl 7y ago
  Twitter has exactly one source of users' emails/phone numbers- the user providing them.
  - phs318u 7y ago
    Sorry but I’m not clear what point you’re trying to make. I may provide a phone number for the express purpose of securing my account but that doesn’t mean I’ve authorised use of that data for marketing. Users are not liable for a company’s misuse of their data (which in this instance is possibly in contravention or Twitter’s privacy policy).
turdnagel 7y ago
Sure, I guess the column was named "twitter_mobile" instead of "twitter_mobile_2fa".
whytai 7y ago
Is this against GDPR?
- jacquesm 7y ago
  That's a rhetorical question I hope? In case it isn't: yes, that's against the GDPR that requires that when data is collected the purpose of the collection is stated and consent is obtained for the use of the information for that purpose. No consent->violation of the law.
  - twanvl 7y ago
    This is not entirely correct, GDPR does not necessarily require consent, see https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#II_Principles https://en.wikipedia.org/wiki/General_Data_Protection_Regula... However, you are right in saying that this violates the GDPR, because the data was collected for a different purpose, and using it for another reason like advertising is not allowed.
    - jacquesm 7y ago
      In this context it does.
riffic 7y ago
https://help.twitter.com/en/managing-your-account/how-to-deactivate-twitter-account https://help.twitter.com/en/managing-your-account/how-to-dea...
jacquesm 7y ago
That bloody rogue engineer again? What is it with that person. Job hopper too, first Volkswagen, then Facebook and now working at Twitter. That's what you get for skipping reference checks.
danShumway 7y ago
Virtually the entire security industry agrees that using phone numbers for account security is an antipattern because of sim-jacking, and yet swaths of the biggest tech companies in the industry do it anyway. I recently got locked out of my Amazon account because I made a large purchase after not ordering anything for ~6-7 months. During the reset process, they tried really hard to get me to set a phone number 'for account security'. From what I could tell from their documentation, it's not even just used for 2FA, it's literally just a way to prove my identity if I need to reset my password. I refused, and then a few days later Amazon called me up to reconfirm the order anyway, even though I had never given them my number. Their entire account recovery process from that point on was based on me having access to information that was already listed on my account, that the hacker would have 100% had access to. It was all just security theater, literally the only thing that mattered was I had access to my email and a phone number. Fastmail (to its credit) allows you to have 2FA without a recovery number, but it requires you to add a recovery number, activate a real 2FA app, and then delete the number. At least it doesn't (as far as I know) use the number on its own for account recovery. Twitter's CEO got hacked because Twitter trusted phone numbers as identity, and they still haven't changed the policy, because collecting phone numbers is fun or something. In theory, a 2FA over SMS is better than nothing. In practice, it trains customers to be insecure and should be avoided. It trains customers to think that identity verification over text is OK. In practice, you can't trust companies not to use it for advertising, or to start using it as identity verification in the future. In practice, there are very, very few legitimate reasons why a company should ever need my phone number, and pretty much none of them have anything to do with security. 99% of your users should be using a 2FA app instead of a phone number. Companies like Twitter should be shamed for misusing security information this way, but they should also be shamed for using insecure authentication methods. I'm convinced that 5 years from now, we're going to look back at SMS authentication the same way we looked at serving login pages over HTTP.
- tictok4 7y ago
  >biggest tech companies in the industry do it anyway. because it provides identity.
  - 7y ago
pezo1919 7y ago
Ok, so what about GDPR now? Now every EU citizen can sue Twitter? Compensation? I am totally fed up with GDPR and its expectation to small/micro companies with the false sense of security it gives to users. SHAME on twitter, shame on Fb, shane on stupid EU.
verst 7y ago
Surprisingly the tailored audience targeting had very little tests and certainly no end to end tests when I was there. Once the whole targeting / matching pipeline was down for 3 days and nobody noticed (I uncovered this) Honestly, I wouldn't be surprised if the pipeline was set up wrong to match against the wrong field. These matching pipelines are just Hadoop jobs (written in Scalding (Scala library for Cascading) and orchestrated / scheduled by Apache Aurora. Internally Twitter generally operated the way you would expect them to as an external user. User data and privacy was taken seriously and no data was given to third parties etc. Source: I worked at Twitter in 2015 as in engineer on ads (on the programmatic ad buying side and partner integrations).
- sofaofthedamned 7y ago
  If Twitter didn't distinguish between phone_2fa and phone_identifier then they really shouldn't be in business.
  - verst 7y ago
    I don't recall how user data was stored or accessed, but I'm certain there will have been separate fields, or at least a flag indicating whether the person opted out from being targeted by their phone number. That being said, it will have been incredibly easy for a single engineer to make this mistake (code review probably should have caught it? But maybe it looked just close enough to the right data source), and it would have been extraordinarily difficult to discover.
    - sofaofthedamned 7y ago
      Not a chance. It's never a single engineer, code gets the PR checked by another engineer and the Jira will be specific with any PII, probably written by committee, all of whom know the importance of the data. Don't conflate this crap with blaming a single nebulous engineer. I've not worked in years at a place that wouldn't understand the importance of PII. Not that it doesn't happen, but let's not mince words here - this was wilfully done.
oneepic 7y ago
Say what you want about the morals of their data collection practices, but at the very least they found it, deemed it inappropriate, removed it (hopefully), and apologized.
- hazelnut 7y ago
  Agree, I think that's the only good thing here.
deleted 7y ago
[deleted]
avocado4 7y ago
Why would somebody ever give their phone number to Twitter, Facebook, or any other service for that matter? You loose anonymity when you give away your phone number.
- opencl 7y ago
  You can't make a Twitter account without a phone number. Well you technically can, but it will be instantly banned upon creation until a phone number is provided.
  - avocado4 7y ago
    I've had a Twitter account for years (to contact customer support). They keep asking me for a phone number but I never provide it. I never got banned.
    - opencl 7y ago
      This is a recent-ish change that only applies to new accounts.
      - avocado4 7y ago
        I still don't get it, I just signed up for a new Twitter account and didn't have to provide a phone number. Was there an official policy change from Twitter? Do you have a link?
        opencl 7y ago
        As far as I'm aware there was never any sort of official policy announcement. They just started banning any new account without a phone number a few minutes after creating it at some point. I personally experienced it a couple of times and there was a big thread about it on here a few months ago[1]. Maybe they changed it back again? [1] https://news.ycombinator.com/item?id=19487304 https://news.ycombinator.com/item?id=19487304
product50 7y ago
I mean, when Facebook came out with a similar admission last year, Twitter should have at least checked that they weren't doing a similar thing. But I guess that would have made them culpable had they discovered the same issue. So, just wait out till some employee "accidentally" discovers it! Twitter would go head over heels trying to remove that one field from their sign up flow to improve the funnel. In fact they will copy what their competitors are doing to understand things better. But when it comes to security or using data, anything goes unless they absolutely have to address it for legal/compliance reasons. Just the state of affairs of tech companies these days.
soulofmischief 7y ago
> safety and security purposes I tried making a Twitter two months ago because I was having trouble with my phone and needed to access T-Mobile's social media-only support team. Within five minutes of making the account, I was banned for "suspicious activity" and required to enter my phone number "for security purposes". But the only reason I made the account is because my phone wasn't working... Emailed support and was told that they could not make an exception for me because I had broken some vague unnamed rule. Then I said the magic words, "This is clearly a ploy to collect phone numbers for data aggregation purposes," and within the next 24 hours my account was unlocked, accompanied by a very salty and accusatory email.
- munk-a 7y ago
  I'm sort of amazed your account was unlocked instead of you just being shown the door. Especially since, as a company policy, letting users like you through is likely to result in very little revenue for users. They're much better off just targeting the tech illiterate folk who can be easily swayed into clicking through ads.
  - talaketu 7y ago
    Twitter has put some effort into the "customer service" use case. https://www.forbes.com/sites/shephyken/2016/04/30/how-to-use-twitter-for-customer-service/#559e316d49f2 https://www.forbes.com/sites/shephyken/2016/04/30/how-to-use... At a basic level, you could think of it as providing the content for the audience - the inventory that is sold to advertisers. Twitter as we know it would not exist if all the users were tweet consumers, and none were tweet producers. T-Mobile is great example of a business providing customer service over Twitter.
- LudwigNagasena 7y ago
  >Within five minutes of making the account, I was banned for "suspicious activity" and required to enter my phone number "for security purposes". The same was done to me. The thought that the point of this was not to take my phone number for advertising never occured to me. It seemed very obvioius and I hope the EU, as the only political actor that sometimes seems to care about people, will do something about this.
munchbunny 7y ago
I imagine some PM and engineering team on the marketing product realized that the phone number was available in the user's database entry, and so... why not expose it indirectly for marketing? It'll make a ton of money! This is exactly why I am a huge fan of the "privacy by design" parts of GDPR and the fact that the regulation places a heavy emphasis on how the data is used in addition to who sees it. It has helped to crystallize the discussion about privacy as not just "what data" but "data + usage". I like that engineers are increasingly required to think about not just what the data is but also how it's being used. When the act of connecting data sources has ethical impact, engineers can't be agnostic.
troydavis 7y ago
To see which Twitter advertisers are targeting you (by email address, phone number, mobile device ID, or Twitter username), go to https://twitter.com/settings/your_twitter_data/audiences https://twitter.com/settings/your_twitter_data/audiences and click "Request advertiser list." Opt out on https://twitter.com/personalization https://twitter.com/personalization (details and screenshot: https://twitter.com/simpleoptout/status/1178290986868297729 https://twitter.com/simpleoptout/status/1178290986868297729)
- llamataboot 7y ago
  huh, I wonder if there is a way to get the audience segments? It says I'm part of over 2500 audiences, but currently being targeted by 0 advertisers.
chasing 7y ago
This sort of shitty behavior will not change until it becomes expensive.
secfirstmd 7y ago
Wonder will they be hit under the GDPR for this...hopefully...
Razengan 7y ago
This should really be taught as a fundamental rule of modern human society by now: Any information that you provide to any company or government will be “misused.”
qwerty456127 7y ago
Whatever information they already have, I don't mind them to use to target advertising. I just don't want them to share it with anybody and I'd like them to have as little information as possible. Does anybody care about ads actually? It obviously is desirable to see none yet if I am shown some I don't care if it's targeted. I would only care about somebody tracking me and leaking data about me to other parties.
dang 7y ago
I don't like these corporate press release titles either but the submitted title, "Twitter misused phone numbers and e-mail to target advertising", seems tendentious. What's an accurate, neutral title we can use above?
- cwkoss 7y ago
  "misused" seems to be the only word with affect, but seems consistent with and descriptive of the facts in the press release. I don't think "Personal information and ads on Twitter" is very descriptive - I prefer the previous title.
cascom 7y ago
I get so annoyed by restaurants that want my phone number - even takeout, “so they can let me know my food/table is ready” even worse are the stores that don’t offer paper receipts, want a receipt provide an email or phone number...
AndrewStephens 7y ago
> We recently discovered that when you provided an email address or phone number for safety or security purposes (for example, two-factor authentication) this data may have inadvertently been used for advertising purposes, specifically in our Tailored Audiences and Partner Audiences advertising system. Nice use of passive voice there, mofos.
- CamperBob2 7y ago
  "Mistakes were made"
- i_am_nomad 7y ago
  They should just take it one small step further and blame it on the data itself. “We discovered that telephone numbers had synced up with advertising profiles. Twitter regrets that the data correlated in this manner.”
- itronitron 7y ago
  Also >> a version of an industry-standard product just so people know that Twitter at least has standards
andresf 7y ago
"...in an effort to be transparent, we wanted to make everyone aware" The fact that the company published this hidden in the help site speaks of how little commitment to that oath they actually have. It doesn't even have a date! If you read the reference to "As of September 17, we have addressed the issue" you don't know when it happened. I guess it might be industry practice, I don't know, but still... it leaves a great deal to be desired for an apologize.
dudul 7y ago
http://www.quickmeme.com/img/b3/b3a10abef396f68423bc6a60d2bbf40cb78298afa309f51c76c94130124b681c.jpg http://www.quickmeme.com/img/b3/b3a10abef396f68423bc6a60d2bb...
diveanon 7y ago
Recently Google started prompting me to use my phone to confirm logins every time using my phone. I went through the recovery process just to make sure that I would be able to access my account and was asked the month and year I opened my gmail account. I have had my gmail for 17+ years and I have no idea when I opened it, and now if I ever lose my phone I will be locked out of my account. Does anyone know where I can see when I opened my account? I travel year round and rarely keep a phone number for more than a few months, 2FA has increasing ly become a problem for me as more and more companies force it on me. Paypal for instance is completely unusable for me, I have been locked out of my own account numerous times.
- hamandcheese 7y ago
  You could check the date if you still have the "Welcome to gmail" email that I assume was sent.
meowface 7y ago
Did anyone else genuinely laugh out loud while reading this? It's so devoid of useful information (we don't know how this happened or at least won't tell you, and we don't know who is affected or how many people are affected) other than "it was an accident". It's just so ridiculous. I do believe them that they don't know who was affected and that this probably wasn't approved by the top brass (in that sense being a kind of accident), but that doesn't speak well to their technical or legal competence.
teddyuk 7y ago
Twitter asks for a phone number for security and then sends sms's to tell you, you have a direct message or to wish you a happy birthday. Twitter know it is a rubbish security system but they do it as it is another channel to send their garbage
- johnisgood 7y ago
  It is also funny because providing a phone number is initially optional. It becomes mandatory when someone tries to log in to your account and fails a couple of times. Your account gets suspended (reason: suspicious activity) until you provide a phone number. Bullshit system that is unfortunately popular.
kilolima 7y ago
I don't understand why people use Twitter to begin with. It's what, 160 characters of text per tweet, right? But to load the webpage, it wants kilobytes or even MBs of data in scripts and media objects, and it doesn't even work with JavaScript or media disabled. To simply show a text message! There's no graceful failsafe mode to display a few bytes of text! This makes one conclude that Twitter is a data gathering and marketing business disguised as a messaging platform. Anything they do as a company should be very, very suspect.

464 points by coloneltcb 7y ago

I don't understand; isn't this literally the point of running a free service? Harvesting data and using it for marketing purposes?

obenn 7y ago
Yes but the user should in principle have some control over what data gets used for such purpose and what doesn't, it is their data.
saagarjha 7y ago
You don't have to do this.
dave5104 7y ago
In this case, Twitter was lying (or more generously, not being entirely truthful) with what they were using the data for. Some users may have chosen not to give up their phone number or email if they had known it would be used for advertising in addition to account security.
- swiley 7y ago
  I just have a hard time imagining anyone wouldn’t expect that, maybe I’m getting paranoid though. I never gave facebook my number even though prompted for it literally every time I logged in.
  - Nextgrid 7y ago
    In fact, prompting every time is also a red flag. They wouldn't be so desperate if providing the number was for your benefit as they claim (for "security", etc). The real reason they're so desperate is because it's for their benefit.
- icedchai 7y ago
  When signing up for a "free" service, I basically assume all data entered will be used for advertising / marketing purposes. This is a safe assumption to make.
  - dave5104 7y ago
    I don't disagree, but I think we should still be able to get upset when a free service uses the data for something other than what they said it would be used for.
  - TeMPOraL 7y ago
    It's why I love GDPR. Since it requires explicit, opt-in consent, I can just register or visit a site and don't worry much - abuse of my data is a bigger risk to the service than it is to me.
    - icedchai 7y ago
      Sounds good on paper. Reality is GDPR isn't going to stop an "error" from happening.
steelframe 7y ago
> Harvesting data and using it for marketing purposes? Twitter's actions make everyone less secure. The next time an online service asks me to enable 2FA to protect my account, I'll have to consider whether the potential for abuse of my 2nd factor information is worth the additional risk to my account.
- tialaramex 7y ago
  FIDO tokens (for U2F or WebAuthn) don't give the relying party anything valuable. If they literally publish everyone's parameters it makes essentially no difference to anything. It doesn't even mean they stop being useful for authentication.
musicale 7y ago
The point of any service, free or otherwise, should be to deliver some kind of benefit to its users. If it doesn't do that, it has little reason to exist. "Data harvesting," marketing and advertising are far from the only business reasons why a company might want to offer a free service. From a business perspective, a free service might - build goodwill for the company - satisfy legal or government requirements - save money on billing while increasing the value of other goods and services from the company - enable the company to qualify for certain grants or subsidies - support the creation and improvement of goods or services (such as software) which the company uses - enable the company to influence industry standards - help to acquire future paying customers (e.g. by offering a free student or limited version which can be upgraded with additional paid features) - help to compete against other companies that charge for the same service - act as a loss leader to encourage sales of compatible companion products or accessories etc.
Nextgrid 7y ago
Not allowing opting out of data collection is actually in breach of the GDPR, so actually in the EU you can not run a business for the sole purpose of stealing data.

hayksaakian 7y ago

"When an advertiser uploaded their marketing list, we may have matched people on Twitter to their list based on the email or phone number the Twitter account holder provided for safety and security purposes. This was an error and we apologize." This doesn't happen accidentally, someone had to engineer, test and build a system that performed reliable targeting.

alxmdev 7y ago
Accidents happen all the time there though, like when they accidentally lock your new account minutes after you create it, and all but force you to give them your phone number in order to reinstate it.
- sofaofthedamned 7y ago
  Same happened to me. However, I did do a support request which 2 days later agreed to let me in without a phone number. 2 days. I think we can file this under 'dark patterns' and finally realise Twitter is attempting to be as abusive as Facebook.
- m463 7y ago
  A week or two ago anything I did with my hacker news account took me to google to solve a recaptcha. (I had blocked google when accessing this site, thanks umatrix) Or I could email them to unblock it (my account has no email address associated with it)
  - dang 7y ago
    Depending on what you mean by "a week or two ago", this was probably because of a botnet attack HN was under in mid-September, when we resorted to turning on recaptcha for logins for a while. We know why people hate this and want to avoid it in the future, but defending HN against attack took priority.
- wpietri 7y ago
  I haven't worked there in a while, but you would not believe the volume of fake account creation they get. Spammers. Fraudsters. Jerks creating a second (or 20th) account to bypass restrictions. And more recently, state actors trying to manipulate things. So I am inclined to cut them some slack on the, "Please prove you're a real user" stuff.

jchw 7y ago

Didn’t this almost-exact same thing happen with Facebook? It’s funny how frequently these kinds of “accidents” happen. They seem to occur with the kinds of frequencies that you might hear a manager or developer say something like, “meh, what’s the worst that could happen?”

throwaway_bad 7y ago
I am still waiting for the same article to be written about google so they can fix their shit too. I got phone calls from google cloud platform even though I am certain I didn't give them my number. They even managed to find my real name even though the only place I used it was for the payment method in the billing account, with a fake name on the google account. This is way too much information to give to their internal sales reps.
- bduerst 7y ago
  You don't need to. If you've ever filled out a form anywhere online to access an article, it's likely you opted in to having your data sold to broker agencies, who sell it for lead gen. The same goes for magazine subscriptions, credit card applications, even debt collectors, etc.
mschuster91 7y ago
> Didn’t this almost-exact same thing happen with Facebook? It’s funny how frequently these kinds of “accidents” happen. Assuming that accidents occur with a specific percentage of data collected, it's not "funny", it's explainable: the more data one has, the greater the chance of things going wrong because someone uses data that is there but should not be used for that purpose. That happens when systems grow so large that they cannot reasonably be understood by a single person.
pwinnski 7y ago
I think instead of "frequently," it happens "consistently." I mean, how many social media companies can we say have not abused these phone numbers?
shkkmo 7y ago

throwaway_bad 7y ago

On twitter/fb, people can look up your account by phone number. This is really fucking stupid because I only added my phone number for two factor authentication. So now I have to choose between security or people finding my dumb throwaway accounts.

spsful 7y ago
You can disable this functionality in the privacy settings for Twitter-- not sure if Facebook allows it, though. Either way I totally agree that it's a dumb feature to have turned on by default.
fireattack 7y ago
It can be disabled (and at least in Twitter's case, I remembered it asked me if I want to enable it).

magicalhippo 7y ago

Raise hands everyone who's surprised by this... They say they inadvertently did it, which may be true. But if they have the data it can be abused. Goes for all those "omg think of the terrorists" data collection plans as well.

musicale 7y ago

At least Twitter is admitting that information collected for one purpose (two factor authentication, account recovery) should not be used for another unrelated purpose (advertising and use by "business partners.")

t0astbread 7y ago
"At least Twitter is admitting that they've heard of the concept of privacy"

sofaofthedamned 7y ago

" we have addressed the issue that allowed this to occur and are no longer using phone numbers or email addresses collected for safety or security purposes for advertising. " Does this mean the matches they've already made on these identifiers are still active?

itronitron 7y ago
Any advertiser that made the match previously will likely have that stored somewhere and will also probably have that identified with the twitter handle, so yeah those identifiers are still active, just not within Twitter.

jsnell 7y ago

Obviously writing an ads targeting system wasn't an accident. But why did it end up using data it wasn't supposed to? It seems unlikely that it was expressly written to work against data they weren't supposed to use for that purpose. It's much more likely that they had multiple data sources for email addresses and phone numbers, and had cross-contamination between the data sources. E.g. maybe they at some point had dozens of databases for user data, all maintained by different teams and grown organically. And then had a big effort to merge them into a single system with a rationally designed schema. And maybe they ended up coalescing all phone numbers of each user from all sources together, with some kind of annotations for why each phone number was collected. And then it's very easy for somebody to screw up the code that's supposed to filtering out security-only phone numbers when ingesting data into the ads targeting system. The above was totally theoretical scenario, but it should be easy to come up with lots of other ways for this to happen by mistake rather than intentionally. Don't think companies make these kinds of mistakes? Both Facebook and Google had issues with plaintext passwords this year. And it should be obvious that neither had anything to gain from that.

sofaofthedamned 7y ago
Bollocks. A phone number is an ideal identifier to match on, they've done exactly the same as FB - pretended it's something for security then gone 'oops'. I've never worked on the same scale as FB or Twitter and I know that this is a no-go area.
opencl 7y ago
Twitter has exactly one source of users' emails/phone numbers- the user providing them.
- phs318u 7y ago
  Sorry but I’m not clear what point you’re trying to make. I may provide a phone number for the express purpose of securing my account but that doesn’t mean I’ve authorised use of that data for marketing. Users are not liable for a company’s misuse of their data (which in this instance is possibly in contravention or Twitter’s privacy policy).

turdnagel 7y ago

Sure, I guess the column was named "twitter_mobile" instead of "twitter_mobile_2fa".

whytai 7y ago

Is this against GDPR?

jacquesm 7y ago
That's a rhetorical question I hope? In case it isn't: yes, that's against the GDPR that requires that when data is collected the purpose of the collection is stated and consent is obtained for the use of the information for that purpose. No consent->violation of the law.
- twanvl 7y ago
  This is not entirely correct, GDPR does not necessarily require consent, see https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#II_Principles https://en.wikipedia.org/wiki/General_Data_Protection_Regula... However, you are right in saying that this violates the GDPR, because the data was collected for a different purpose, and using it for another reason like advertising is not allowed.
  - jacquesm 7y ago
    In this context it does.

riffic 7y ago

https://help.twitter.com/en/managing-your-account/how-to-deactivate-twitter-account https://help.twitter.com/en/managing-your-account/how-to-dea...

jacquesm 7y ago

That bloody rogue engineer again? What is it with that person. Job hopper too, first Volkswagen, then Facebook and now working at Twitter. That's what you get for skipping reference checks.

danShumway 7y ago

Virtually the entire security industry agrees that using phone numbers for account security is an antipattern because of sim-jacking, and yet swaths of the biggest tech companies in the industry do it anyway. I recently got locked out of my Amazon account because I made a large purchase after not ordering anything for ~6-7 months. During the reset process, they tried really hard to get me to set a phone number 'for account security'. From what I could tell from their documentation, it's not even just used for 2FA, it's literally just a way to prove my identity if I need to reset my password. I refused, and then a few days later Amazon called me up to reconfirm the order anyway, even though I had never given them my number. Their entire account recovery process from that point on was based on me having access to information that was already listed on my account, that the hacker would have 100% had access to. It was all just security theater, literally the only thing that mattered was I had access to my email and a phone number. Fastmail (to its credit) allows you to have 2FA without a recovery number, but it requires you to add a recovery number, activate a real 2FA app, and then delete the number. At least it doesn't (as far as I know) use the number on its own for account recovery. Twitter's CEO got hacked because Twitter trusted phone numbers as identity, and they still haven't changed the policy, because collecting phone numbers is fun or something. In theory, a 2FA over SMS is better than nothing. In practice, it trains customers to be insecure and should be avoided. It trains customers to think that identity verification over text is OK. In practice, you can't trust companies not to use it for advertising, or to start using it as identity verification in the future. In practice, there are very, very few legitimate reasons why a company should ever need my phone number, and pretty much none of them have anything to do with security. 99% of your users should be using a 2FA app instead of a phone number. Companies like Twitter should be shamed for misusing security information this way, but they should also be shamed for using insecure authentication methods. I'm convinced that 5 years from now, we're going to look back at SMS authentication the same way we looked at serving login pages over HTTP.

tictok4 7y ago
>biggest tech companies in the industry do it anyway. because it provides identity.
- 7y ago

pezo1919 7y ago

Ok, so what about GDPR now? Now every EU citizen can sue Twitter? Compensation? I am totally fed up with GDPR and its expectation to small/micro companies with the false sense of security it gives to users. SHAME on twitter, shame on Fb, shane on stupid EU.

verst 7y ago

Surprisingly the tailored audience targeting had very little tests and certainly no end to end tests when I was there. Once the whole targeting / matching pipeline was down for 3 days and nobody noticed (I uncovered this) Honestly, I wouldn't be surprised if the pipeline was set up wrong to match against the wrong field. These matching pipelines are just Hadoop jobs (written in Scalding (Scala library for Cascading) and orchestrated / scheduled by Apache Aurora. Internally Twitter generally operated the way you would expect them to as an external user. User data and privacy was taken seriously and no data was given to third parties etc. Source: I worked at Twitter in 2015 as in engineer on ads (on the programmatic ad buying side and partner integrations).

sofaofthedamned 7y ago
If Twitter didn't distinguish between phone_2fa and phone_identifier then they really shouldn't be in business.
- verst 7y ago
  I don't recall how user data was stored or accessed, but I'm certain there will have been separate fields, or at least a flag indicating whether the person opted out from being targeted by their phone number. That being said, it will have been incredibly easy for a single engineer to make this mistake (code review probably should have caught it? But maybe it looked just close enough to the right data source), and it would have been extraordinarily difficult to discover.
  - sofaofthedamned 7y ago
    Not a chance. It's never a single engineer, code gets the PR checked by another engineer and the Jira will be specific with any PII, probably written by committee, all of whom know the importance of the data. Don't conflate this crap with blaming a single nebulous engineer. I've not worked in years at a place that wouldn't understand the importance of PII. Not that it doesn't happen, but let's not mince words here - this was wilfully done.

oneepic 7y ago

Say what you want about the morals of their data collection practices, but at the very least they found it, deemed it inappropriate, removed it (hopefully), and apologized.

hazelnut 7y ago
Agree, I think that's the only good thing here.

deleted 7y ago

[deleted]

avocado4 7y ago

Why would somebody ever give their phone number to Twitter, Facebook, or any other service for that matter? You loose anonymity when you give away your phone number.

opencl 7y ago
You can't make a Twitter account without a phone number. Well you technically can, but it will be instantly banned upon creation until a phone number is provided.
- avocado4 7y ago
  I've had a Twitter account for years (to contact customer support). They keep asking me for a phone number but I never provide it. I never got banned.
  - opencl 7y ago
    This is a recent-ish change that only applies to new accounts.
    - avocado4 7y ago
      I still don't get it, I just signed up for a new Twitter account and didn't have to provide a phone number. Was there an official policy change from Twitter? Do you have a link?
      - opencl 7y ago
        As far as I'm aware there was never any sort of official policy announcement. They just started banning any new account without a phone number a few minutes after creating it at some point. I personally experienced it a couple of times and there was a big thread about it on here a few months ago[1]. Maybe they changed it back again? [1] https://news.ycombinator.com/item?id=19487304 https://news.ycombinator.com/item?id=19487304

product50 7y ago

I mean, when Facebook came out with a similar admission last year, Twitter should have at least checked that they weren't doing a similar thing. But I guess that would have made them culpable had they discovered the same issue. So, just wait out till some employee "accidentally" discovers it! Twitter would go head over heels trying to remove that one field from their sign up flow to improve the funnel. In fact they will copy what their competitors are doing to understand things better. But when it comes to security or using data, anything goes unless they absolutely have to address it for legal/compliance reasons. Just the state of affairs of tech companies these days.

soulofmischief 7y ago

> safety and security purposes I tried making a Twitter two months ago because I was having trouble with my phone and needed to access T-Mobile's social media-only support team. Within five minutes of making the account, I was banned for "suspicious activity" and required to enter my phone number "for security purposes". But the only reason I made the account is because my phone wasn't working... Emailed support and was told that they could not make an exception for me because I had broken some vague unnamed rule. Then I said the magic words, "This is clearly a ploy to collect phone numbers for data aggregation purposes," and within the next 24 hours my account was unlocked, accompanied by a very salty and accusatory email.

munk-a 7y ago
I'm sort of amazed your account was unlocked instead of you just being shown the door. Especially since, as a company policy, letting users like you through is likely to result in very little revenue for users. They're much better off just targeting the tech illiterate folk who can be easily swayed into clicking through ads.
- talaketu 7y ago
  Twitter has put some effort into the "customer service" use case. https://www.forbes.com/sites/shephyken/2016/04/30/how-to-use-twitter-for-customer-service/#559e316d49f2 https://www.forbes.com/sites/shephyken/2016/04/30/how-to-use... At a basic level, you could think of it as providing the content for the audience - the inventory that is sold to advertisers. Twitter as we know it would not exist if all the users were tweet consumers, and none were tweet producers. T-Mobile is great example of a business providing customer service over Twitter.
LudwigNagasena 7y ago
>Within five minutes of making the account, I was banned for "suspicious activity" and required to enter my phone number "for security purposes". The same was done to me. The thought that the point of this was not to take my phone number for advertising never occured to me. It seemed very obvioius and I hope the EU, as the only political actor that sometimes seems to care about people, will do something about this.

munchbunny 7y ago

I imagine some PM and engineering team on the marketing product realized that the phone number was available in the user's database entry, and so... why not expose it indirectly for marketing? It'll make a ton of money! This is exactly why I am a huge fan of the "privacy by design" parts of GDPR and the fact that the regulation places a heavy emphasis on how the data is used in addition to who sees it. It has helped to crystallize the discussion about privacy as not just "what data" but "data + usage". I like that engineers are increasingly required to think about not just what the data is but also how it's being used. When the act of connecting data sources has ethical impact, engineers can't be agnostic.

troydavis 7y ago

To see which Twitter advertisers are targeting you (by email address, phone number, mobile device ID, or Twitter username), go to https://twitter.com/settings/your_twitter_data/audiences https://twitter.com/settings/your_twitter_data/audiences and click "Request advertiser list." Opt out on https://twitter.com/personalization https://twitter.com/personalization (details and screenshot: https://twitter.com/simpleoptout/status/1178290986868297729 https://twitter.com/simpleoptout/status/1178290986868297729)

llamataboot 7y ago
huh, I wonder if there is a way to get the audience segments? It says I'm part of over 2500 audiences, but currently being targeted by 0 advertisers.

chasing 7y ago

This sort of shitty behavior will not change until it becomes expensive.

secfirstmd 7y ago

Wonder will they be hit under the GDPR for this...hopefully...

Razengan 7y ago

This should really be taught as a fundamental rule of modern human society by now: Any information that you provide to any company or government will be “misused.”

qwerty456127 7y ago

Whatever information they already have, I don't mind them to use to target advertising. I just don't want them to share it with anybody and I'd like them to have as little information as possible. Does anybody care about ads actually? It obviously is desirable to see none yet if I am shown some I don't care if it's targeted. I would only care about somebody tracking me and leaking data about me to other parties.

dang 7y ago

I don't like these corporate press release titles either but the submitted title, "Twitter misused phone numbers and e-mail to target advertising", seems tendentious. What's an accurate, neutral title we can use above?

cwkoss 7y ago
"misused" seems to be the only word with affect, but seems consistent with and descriptive of the facts in the press release. I don't think "Personal information and ads on Twitter" is very descriptive - I prefer the previous title.

cascom 7y ago

I get so annoyed by restaurants that want my phone number - even takeout, “so they can let me know my food/table is ready” even worse are the stores that don’t offer paper receipts, want a receipt provide an email or phone number...

AndrewStephens 7y ago

> We recently discovered that when you provided an email address or phone number for safety or security purposes (for example, two-factor authentication) this data may have inadvertently been used for advertising purposes, specifically in our Tailored Audiences and Partner Audiences advertising system. Nice use of passive voice there, mofos.

CamperBob2 7y ago
"Mistakes were made"
i_am_nomad 7y ago
They should just take it one small step further and blame it on the data itself. “We discovered that telephone numbers had synced up with advertising profiles. Twitter regrets that the data correlated in this manner.”
itronitron 7y ago
Also >> a version of an industry-standard product just so people know that Twitter at least has standards

andresf 7y ago

"...in an effort to be transparent, we wanted to make everyone aware" The fact that the company published this hidden in the help site speaks of how little commitment to that oath they actually have. It doesn't even have a date! If you read the reference to "As of September 17, we have addressed the issue" you don't know when it happened. I guess it might be industry practice, I don't know, but still... it leaves a great deal to be desired for an apologize.

dudul 7y ago

http://www.quickmeme.com/img/b3/b3a10abef396f68423bc6a60d2bbf40cb78298afa309f51c76c94130124b681c.jpg http://www.quickmeme.com/img/b3/b3a10abef396f68423bc6a60d2bb...

diveanon 7y ago

Recently Google started prompting me to use my phone to confirm logins every time using my phone. I went through the recovery process just to make sure that I would be able to access my account and was asked the month and year I opened my gmail account. I have had my gmail for 17+ years and I have no idea when I opened it, and now if I ever lose my phone I will be locked out of my account. Does anyone know where I can see when I opened my account? I travel year round and rarely keep a phone number for more than a few months, 2FA has increasing ly become a problem for me as more and more companies force it on me. Paypal for instance is completely unusable for me, I have been locked out of my own account numerous times.

hamandcheese 7y ago
You could check the date if you still have the "Welcome to gmail" email that I assume was sent.

meowface 7y ago

Did anyone else genuinely laugh out loud while reading this? It's so devoid of useful information (we don't know how this happened or at least won't tell you, and we don't know who is affected or how many people are affected) other than "it was an accident". It's just so ridiculous. I do believe them that they don't know who was affected and that this probably wasn't approved by the top brass (in that sense being a kind of accident), but that doesn't speak well to their technical or legal competence.

teddyuk 7y ago

Twitter asks for a phone number for security and then sends sms's to tell you, you have a direct message or to wish you a happy birthday. Twitter know it is a rubbish security system but they do it as it is another channel to send their garbage

johnisgood 7y ago
It is also funny because providing a phone number is initially optional. It becomes mandatory when someone tries to log in to your account and fails a couple of times. Your account gets suspended (reason: suspicious activity) until you provide a phone number. Bullshit system that is unfortunately popular.

kilolima 7y ago

I don't understand why people use Twitter to begin with. It's what, 160 characters of text per tweet, right? But to load the webpage, it wants kilobytes or even MBs of data in scripts and media objects, and it doesn't even work with JavaScript or media disabled. To simply show a text message! There's no graceful failsafe mode to display a few bytes of text! This makes one conclude that Twitter is a data gathering and marketing business disguised as a messaging platform. Anything they do as a company should be very, very suspect.