4 ms·

Hopefully the FTC sees this comment and fines Twitter a couple billion for privacy violations.

verst 7y ago
That doesn't make any sense. I have not seen any evidence of wrong doing or improper use of data [edit for clarification: I'm talking about my literal observation in 2015]. Happy to speak on the record.
- TheSpiceIsLife 7y ago
  > have not seen any evidence of wrong doing They admit to using 2FA phone numbers for advertising purposes. How is this not wrong doing? That they believe it was a mistake doesn’t make it right doing.
  - wpietri 7y ago
    Exactly. "Whoops, we did a thing that accidentally made us money," is not the most confidence-inspiring excuse. One, that's a very convenient accident. And two, if procedures around private data are so sloppy that one small accident can do this, that strikes me as the kind of negligence that a regulator should punish vigorously.
  - verst 7y ago
    Yes that is wrong-doing but I have not seen any evidence during my time there that such a move would have been intentional. I'm very inclined to believe it was an unfortunate mistake. A mistake that probably should not have been possible. I'm not sure why or how it was.
    - TheSpiceIsLife 7y ago
      Intention or not it is still wrong. Intention should have an impact on punishment / reparation outcomes, but it shouldn’t necessarily impact guilt.
    - ABeeSea 7y ago
      Intention doesn’t matter.
- ABeeSea 7y ago
  Then you admit that twitter has a deficient mechanism for dealing with PII data? You can’t blame this on a single engineer. It’s the product manager, the technical lead, the engineer and the legal mechanisms for PII that led to this breach. An engineer working on ad tech should have never had access to the PII used for security. Just a shit show all around. They should be deeply fined.
  - verst 7y ago
    I have zero insight into how the 2FA phone number was stored or how it could have been accessed. I can't admit to anything I don't know about :) I agree that in a well designed system and process 2FA numbers should not be accessible (like passwords). However, I've seen this as a common practice in quite a few startups.

That doesn't make any sense. I have not seen any evidence of wrong doing or improper use of data [edit for clarification: I'm talking about my literal observation in 2015]. Happy to speak on the record.

TheSpiceIsLife 7y ago
> have not seen any evidence of wrong doing They admit to using 2FA phone numbers for advertising purposes. How is this not wrong doing? That they believe it was a mistake doesn’t make it right doing.
- wpietri 7y ago
  Exactly. "Whoops, we did a thing that accidentally made us money," is not the most confidence-inspiring excuse. One, that's a very convenient accident. And two, if procedures around private data are so sloppy that one small accident can do this, that strikes me as the kind of negligence that a regulator should punish vigorously.
- verst 7y ago
  Yes that is wrong-doing but I have not seen any evidence during my time there that such a move would have been intentional. I'm very inclined to believe it was an unfortunate mistake. A mistake that probably should not have been possible. I'm not sure why or how it was.
  - TheSpiceIsLife 7y ago
    Intention or not it is still wrong. Intention should have an impact on punishment / reparation outcomes, but it shouldn’t necessarily impact guilt.
  - ABeeSea 7y ago
    Intention doesn’t matter.
ABeeSea 7y ago
Then you admit that twitter has a deficient mechanism for dealing with PII data? You can’t blame this on a single engineer. It’s the product manager, the technical lead, the engineer and the legal mechanisms for PII that led to this breach. An engineer working on ad tech should have never had access to the PII used for security. Just a shit show all around. They should be deeply fined.
- verst 7y ago
  I have zero insight into how the 2FA phone number was stored or how it could have been accessed. I can't admit to anything I don't know about :) I agree that in a well designed system and process 2FA numbers should not be accessible (like passwords). However, I've seen this as a common practice in quite a few startups.