3 ms·

I was amazed when I found out about this "trick" a year or two ago. It basically means that if you've used your personal email or phone number to create an "ano

I was amazed when I found out about this "trick" a year or two ago. It basically means that if you've used your personal email or phone number to create an "anonymous" twitter handle (e.g. a whistleblower, leaker, etc.), then it's not anonymous at all. Someone can just put batches of emails into their gmail account (e.g. journalists' public emails, their employees' emails, other suspects), then use the Twitter contacts-import functionality to import those emails and match them up with Twitter account handles. It's insane. I first saw people explaining how to do this on Quora a year or two ago, but here's another explanation that was posted just a few days before this announcement: https://www.quora.com/How-228/answer/William-Boyd-181 https://www.quora.com/How-228/answer/William-Boyd-181 Twitter MUST have known about this loophole for many years. It's nigh on impossible that they are that incompetent, so, as far as I can see, they were just ignoring the loophole because they didn't want to slow down their growth by removing the feature. As with all social networks, the most important factor in keeping users is to quickly get them a network of followers and followees. EDIT: > "People who did not have this setting enabled or do not have a phone number associated with their account were not exposed by this vulnerability," Twitter said. This spokesperson is extremely sneaky. They completely neglect to mention that the "let others find me by email" is checked by default, and so we can only assume that anyone who has a publicly scrape-able email somewhere (basically everyone, because you've got to count all the leaked databases too - see: haveibeenpwned.com) has had their Twitter handle linked to that email. Atheist bloggers in Saudi Arabia, whistleblowers in the US, opposition activists in Russia, and so on - all potentially fucked over (past tense) by this. And while I'm ranting: What's worse is that they apparently haven't disabled that API. They've just removed a few big crawler swarms. But the thing is, Russia / Saudi Arabia / etc. probably have narrowed their suspects down to 500 (or so) emails anyway, so they can discover the heretic/activist in a SINGLE API REQUEST! So Twitter has done nothing to fix this loophole.

yomly 7y ago
Yes this is the thing everyone should be talking about. Think of any of the bigger Twitter posters on Hong Kong. If anyone of the ring leaders didn't decouple their twitter handle from everything else they will have a giant bullseye painted on them by CCP
C4stor 7y ago
The first thing twitter proposes when you create an account : "Do you want to match emails and phone numbers to account". In this thread : "How can it be possible to match emails and phone numbers to accounts?" It's not a loophole, it's a feature. It's in the TOS before you sign up : "Twitter also uses your contact information to market to you as your country’s laws allow, and to help others find your account if your settings permit, including through third-party services and client applications." How can someone then not realize this is a possibility ? At what moment can someone start to even begin to think twitter is a safe place for endangered people ? It's an ad company, what do you expect really ?
- rewq4321 7y ago
  The fact that you're citing the TOS is not exactly helping your case, since it's well known that basically no one reads those. I'm not as concerned about techy people as I am about the average person's understanding of their identity privacy on Twitter. But even as a techy person I was surprised by how easy it is for a random person to link millions of identities. And I'm obviously not alone given that this post made it to the front page. So when you say "what do you expect really?" - well, most people expect that a random person can't discover their email from their twitter handle. I think that's a completely fair expectation, and people should rightly be concerned about this "feature". Posts like this should be upvoted, because a lot of people aren't aware. Your incredulity here tends to come across as "it's in the TOS, you're all pretty ignorant, I knew about this all along." which isn't all that helpful, even if it's all true.
Forgivenessizer 7y ago
We need to nationalize Twitter & FB & Google, so we can get some decent privacy options. Without this, it will be impossible for us to secure friends and family we care about. Sure nerds can secure things themselves, but that's totally insufficient. Until then, things will only get worse.

yomly 7y ago

Yes this is the thing everyone should be talking about. Think of any of the bigger Twitter posters on Hong Kong. If anyone of the ring leaders didn't decouple their twitter handle from everything else they will have a giant bullseye painted on them by CCP

C4stor 7y ago

The first thing twitter proposes when you create an account : "Do you want to match emails and phone numbers to account". In this thread : "How can it be possible to match emails and phone numbers to accounts?" It's not a loophole, it's a feature. It's in the TOS before you sign up : "Twitter also uses your contact information to market to you as your country’s laws allow, and to help others find your account if your settings permit, including through third-party services and client applications." How can someone then not realize this is a possibility ? At what moment can someone start to even begin to think twitter is a safe place for endangered people ? It's an ad company, what do you expect really ?

rewq4321 7y ago
The fact that you're citing the TOS is not exactly helping your case, since it's well known that basically no one reads those. I'm not as concerned about techy people as I am about the average person's understanding of their identity privacy on Twitter. But even as a techy person I was surprised by how easy it is for a random person to link millions of identities. And I'm obviously not alone given that this post made it to the front page. So when you say "what do you expect really?" - well, most people expect that a random person can't discover their email from their twitter handle. I think that's a completely fair expectation, and people should rightly be concerned about this "feature". Posts like this should be upvoted, because a lot of people aren't aware. Your incredulity here tends to come across as "it's in the TOS, you're all pretty ignorant, I knew about this all along." which isn't all that helpful, even if it's all true.

Forgivenessizer 7y ago

We need to nationalize Twitter & FB & Google, so we can get some decent privacy options. Without this, it will be impossible for us to secure friends and family we care about. Sure nerds can secure things themselves, but that's totally insufficient. Until then, things will only get worse.