3 ms·

I would have avoided the obvious doubling scam and gone for "donate bitcoin to this charity". Maybe with an explanation of how bitcoin can make it directly to

by LanceH 6y ago

I would have avoided the obvious doubling scam and gone for "donate bitcoin to this charity". Maybe with an explanation of how bitcoin can make it directly to the country where it is needed immediately.

meowface 6y ago
That's actually a pretty good idea. Your idea is the first one I've read out of hundreds that I think could've possibly been a more optimal strategy. It's tough to know for sure if it would've made more, though. Given the limited time window, I think I slightly lean towards exploiting greed vs. exploiting altruism. If they could somehow keep he tweets up for over 24 hours, I think your idea would likely win, but given they may have thought they might have about an hour, I think the scam route might've been more reliable.
- elliotbnvl 6y ago
  Probably the most effective strategy would have been to diversify by posting various kinds of messages, some of which would be more effective and some of which would be less effective. Also would have been less likely to seem coordinated. But the general sloppiness of the stratagem points towards not having the time / resources to do that.
- LanceH 6y ago
  Someone else suggested posting different BTC addresses per account and framing it as a quick charity drive contest. Which is a better version of this, IMO. As for which one would win, I don't know. I can see the argument of immediacy with the scam. The charity scam I think would draw in a lot more smaller donors but I can't see them feeling the need to immediately send. Personally I would have gone with the bounty, then shamed Twitter for the (probably) low payout in an effort to promote my brand.
  - meowface 6y ago
    >Personally I would have gone with the bounty, then shamed Twitter for the (probably) low payout in an effort to promote my brand. The problem is that the attack requires active social engineering to pull off, so it probably wouldn't have been eligible for a bounty. "I could trick your employees and gain access to user accounts" isn't really covered.
codesternews 6y ago
Yes this. I was thing same. It would have more real and more people would have fall for this. Even media could have fall. Than they can come with Jeff Bezos yes I'm donating too. It would have more real.
zakember 6y ago
The reason why (I think) this was less likely to work was because of haste. The hackers knew their tweets would be pulled down in a few minutes or so, so they had to put out tweets saying "in the next 30 mins" for people to send money immediately. This works well in what they tried, but asking people to donate in the next 30 mins would certainly have made it look suspicious.

by LanceH 6y ago

meowface 6y ago

That's actually a pretty good idea. Your idea is the first one I've read out of hundreds that I think could've possibly been a more optimal strategy. It's tough to know for sure if it would've made more, though. Given the limited time window, I think I slightly lean towards exploiting greed vs. exploiting altruism. If they could somehow keep he tweets up for over 24 hours, I think your idea would likely win, but given they may have thought they might have about an hour, I think the scam route might've been more reliable.

elliotbnvl 6y ago
Probably the most effective strategy would have been to diversify by posting various kinds of messages, some of which would be more effective and some of which would be less effective. Also would have been less likely to seem coordinated. But the general sloppiness of the stratagem points towards not having the time / resources to do that.
LanceH 6y ago
Someone else suggested posting different BTC addresses per account and framing it as a quick charity drive contest. Which is a better version of this, IMO. As for which one would win, I don't know. I can see the argument of immediacy with the scam. The charity scam I think would draw in a lot more smaller donors but I can't see them feeling the need to immediately send. Personally I would have gone with the bounty, then shamed Twitter for the (probably) low payout in an effort to promote my brand.
- meowface 6y ago
  >Personally I would have gone with the bounty, then shamed Twitter for the (probably) low payout in an effort to promote my brand. The problem is that the attack requires active social engineering to pull off, so it probably wouldn't have been eligible for a bounty. "I could trick your employees and gain access to user accounts" isn't really covered.

codesternews 6y ago

Yes this. I was thing same. It would have more real and more people would have fall for this. Even media could have fall. Than they can come with Jeff Bezos yes I'm donating too. It would have more real.

zakember 6y ago

The reason why (I think) this was less likely to work was because of haste. The hackers knew their tweets would be pulled down in a few minutes or so, so they had to put out tweets saying "in the next 30 mins" for people to send money immediately. This works well in what they tried, but asking people to donate in the next 30 mins would certainly have made it look suspicious.