4 ms·
Obviously writing an ads targeting system wasn't an accident. But why did it end up using data it wasn't supposed to? It seems unlikely that it was expressly wr
by jsnell 7y ago
Obviously writing an ads targeting system wasn't an accident. But why did it end up using data it wasn't supposed to? It seems unlikely that it was expressly written to work against data they weren't supposed to use for that purpose. It's much more likely that they had multiple data sources for email addresses and phone numbers, and had cross-contamination between the data sources.
E.g. maybe they at some point had dozens of databases for user data, all maintained by different teams and grown organically. And then had a big effort to merge them into a single system with a rationally designed schema. And maybe they ended up coalescing all phone numbers of each user from all sources together, with some kind of annotations for why each phone number was collected. And then it's very easy for somebody to screw up the code that's supposed to filtering out security-only phone numbers when ingesting data into the ads targeting system.
The above was totally theoretical scenario, but it should be easy to come up with lots of other ways for this to happen by mistake rather than intentionally. Don't think companies make these kinds of mistakes? Both Facebook and Google had issues with plaintext passwords this year. And it should be obvious that neither had anything to gain from that.
- sofaofthedamned 7y agoBollocks. A phone number is an ideal identifier to match on, they've done exactly the same as FB - pretended it's something for security then gone 'oops'. I've never worked on the same scale as FB or Twitter and I know that this is a no-go area.
- opencl 7y agoTwitter has exactly one source of users' emails/phone numbers- the user providing them.
- phs318u 7y agoSorry but I’m not clear what point you’re trying to make. I may provide a phone number for the express purpose of securing my account but that doesn’t mean I’ve authorised use of that data for marketing. Users are not liable for a company’s misuse of their data (which in this instance is possibly in contravention or Twitter’s privacy policy).
- opencl 7y agoThe point I'm trying to make is that nobody authorized the use of their data for marketing. As far as I'm aware the only phone numbers they have are ones submitted for 2FA purposes, I don't see how they could have possibly accidentally mixed them up with some other source of phone numbers. If there is some sort of opt-in to use your phone number for ad targeting purposes they have done an incredibly good job of hiding it in the UI.
- phs318u 7y agoAh ok. We’re in violent agreement. I actually thought you were implying the opposite. My bad.
- itronitron 7y agoThey seem to have been allowing the use of phone numbers as a search parameter when matching result sets for their 'trusted partners', which means they are revealing user's phone numbers without technically giving the phone numbers to the trusted partners. Very poor OpSec as it allows an advertising partner to further segment its proprietary database with users' twitter profiles (how much data is available there, public or private, I don't know.) I have a hard time believing that Twitter didn't know this.
- jsnell 7y agoIf they didn’t have other data sources for this, they would have shut down the now useless ads targeting features.
- mateo411 7y agoThere are other identifiers that can be used for targeted advertising besides email addresses and phone numbers.
- egdod 7y agoTwitter could easily have dozens of sources of this data. What makes you think this is the only one?