5 ms·

‘Two people’ misses the entire problem here. If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the pu

‘Two people’ misses the entire problem here. If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account. That chain should be documented somewhere - there must be some record in the ‘verified account management’ system that says something to the effect of ‘after we gave this actual verified human this token, this email from this address arrived on this date containing that token, establishing that this person had control over that email address on that date’. If random twitter admins can change the email address and disable 2fa on verified twitter accounts, and those accounts can still publish tweets without them going into a ‘held pending verification that the blue check mark still applies to the person now in control of that account’ queue, then twitter verification doesn’t mean much. Which might be of interest to organizations like the SEC who hold that communications over a verified twitter account count as official corporate notices, and various public safety organizations that have let it be known that messages on their twitter can be relied on as a source of official information during natural disasters... Twitter needs to get serious about blue checks.

Thorrez 6y ago
> held pending verification that the blue check mark still applies to the person now in control of that account That sounds to me like it's simply having a 2nd person verify the email change is correct. So your suggestion and the article's suggestion ("should at least need two people to change key settings") seem to be very similar if not the same as each other.
- jameshart 6y ago
  Process can be automated depending on how the account needs to be verified. Might be that say for a brand account it is connected to a domain ownership/verification model, where 1) email address must be in a particular domain, and 2) email must be able to complete a challenge/response process that demonstrates they control the company website - eg some random value is sent to the email address and they have to make it available via an https resource on the company domain. For personal celebrity accounts maybe verification is just that the email address must send in a scan of a government photo Id, and sure maybe that triggers a manual check, but it’s not just a ‘two keys’ solution - it’s a verification process. Sure, the same admin console might be able to go in and change the verification mode and rules on a verified account - but that’s something that would happen rarely, and a flurry of activity changing the verification process for a bunch of accounts would definitely merit a red flag.
  - Thorrez 6y ago
    I guess that's plausible. But on the other hand Twitter got plenty of red flags with this attack but still struggled to stop it. And is our goal detection or prevention?
kanox 6y ago
> If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account. Not really, a blue checkmark is just a status symbol.
- antihero 6y ago
  It gives validity and implies trust.
- Jaruzel 6y ago
  This is exactly the problem with the blue tick. It's basically meaningless other than as a budge of honour. It's also restricted to large companies and 'public' figures. What I'd like to see is, the Blue Tick being restored to be an actual mark of Verification, and be something that anyone can apply for with the appropriate identification documentation. Additionally, there should then be a toggle switch, where only Verified accounts see tweets and replies from other Verified accounts[1]. This would effectively create two Twitters; one where every account is identifiable and accountable for what they tweet, and another that continues with the anarchic system they have now, where hate speech, racism and intolerance run rife[2]. --- [1] I've heard rumours that this toggle switch already exists on Verified accounts - can anyone confirm ? [2] Yes, free speech may be trapped here too, unless some sort of middle ground can be worked out.
  - adrianhon 6y ago
    [1] Sort of. It's a tab on the Notifications screen that only shows replies/likes/mentions from other Verified accounts.
    - Jaruzel 6y ago
      Thought so. Thanks!
  - joosters 6y ago
    Sounds just like the 'real names' policy that Google and Facebook have tried before. That never made any difference to hate speech, racism and intolerance, so why do you think it will magically make Twitter better?
ponker 6y ago
Twitter's blue check is a growth hack, not a notary public.
- jameshart 6y ago
  De facto or de jure?
throw737 6y ago
PGP solved this issue 30 years ago. I can not believe we have this discussion in 2020
- baaym 6y ago
  I don't tweet much, but when I do I'd love to be able to sign them like I sign my git commits.
  - tuxcanfly 6y ago
    We did exactly this for a side project last week: https://github.com/shabda/tweet-signer https://github.com/shabda/tweet-signer At it's core it's just a spec, so feel free to write your own tools! Suggestions for improving the spec welcome. Please use Github issues
- tsimionescu 6y ago
  Except that the problem isn't the signature itself, it's the required infrastructure. Grandma doesn't know how to check The Donald's signature. And, of course, the infrastructure is hard (just check the unfixable problems with the PGP persistent DOS attacks that were discussed a year or 2 ago).
  - jameshart 6y ago
    Twitter knows how to check a signature though.
C1sc0cat 6y ago
As twitter only has about 5k Employees having more than 1k ie over 20% with access like this is shocking and the fact that "j random "contractor" has access even more so. Twitter needs to get serious period and not just blue checks. Also a lot of the other FANG type companies are effectively CNI - I think they need to start properly vetting people and I mean real security clearance possibly including TS
laughinghan 6y ago
pending verification that the blue check mark still applies to the person now in control of that account Why would you want to ever allow an admin to transfer control of a verified account to an unverified person? If you're saying that the account recovery process needs to be at least as secure as the credential that was verified (e.g. email address), then I agree. But I don't think reversion to a "pending" state would ever be desirable, though.
Thorentis 6y ago
This is all very true, assuming that was the purpose of the blue check. But it isn't. It's a status symbol that people also see as adding legitimacy to the tweets of an account.

Thorrez 6y ago

> held pending verification that the blue check mark still applies to the person now in control of that account That sounds to me like it's simply having a 2nd person verify the email change is correct. So your suggestion and the article's suggestion ("should at least need two people to change key settings") seem to be very similar if not the same as each other.

jameshart 6y ago
Process can be automated depending on how the account needs to be verified. Might be that say for a brand account it is connected to a domain ownership/verification model, where 1) email address must be in a particular domain, and 2) email must be able to complete a challenge/response process that demonstrates they control the company website - eg some random value is sent to the email address and they have to make it available via an https resource on the company domain. For personal celebrity accounts maybe verification is just that the email address must send in a scan of a government photo Id, and sure maybe that triggers a manual check, but it’s not just a ‘two keys’ solution - it’s a verification process. Sure, the same admin console might be able to go in and change the verification mode and rules on a verified account - but that’s something that would happen rarely, and a flurry of activity changing the verification process for a bunch of accounts would definitely merit a red flag.
- Thorrez 6y ago
  I guess that's plausible. But on the other hand Twitter got plenty of red flags with this attack but still struggled to stop it. And is our goal detection or prevention?

kanox 6y ago

> If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account. Not really, a blue checkmark is just a status symbol.

antihero 6y ago
It gives validity and implies trust.
Jaruzel 6y ago
This is exactly the problem with the blue tick. It's basically meaningless other than as a budge of honour. It's also restricted to large companies and 'public' figures. What I'd like to see is, the Blue Tick being restored to be an actual mark of Verification, and be something that anyone can apply for with the appropriate identification documentation. Additionally, there should then be a toggle switch, where only Verified accounts see tweets and replies from other Verified accounts[1]. This would effectively create two Twitters; one where every account is identifiable and accountable for what they tweet, and another that continues with the anarchic system they have now, where hate speech, racism and intolerance run rife[2]. --- [1] I've heard rumours that this toggle switch already exists on Verified accounts - can anyone confirm ? [2] Yes, free speech may be trapped here too, unless some sort of middle ground can be worked out.
- adrianhon 6y ago
  [1] Sort of. It's a tab on the Notifications screen that only shows replies/likes/mentions from other Verified accounts.
  - Jaruzel 6y ago
    Thought so. Thanks!
- joosters 6y ago
  Sounds just like the 'real names' policy that Google and Facebook have tried before. That never made any difference to hate speech, racism and intolerance, so why do you think it will magically make Twitter better?

ponker 6y ago

Twitter's blue check is a growth hack, not a notary public.

jameshart 6y ago
De facto or de jure?

throw737 6y ago

PGP solved this issue 30 years ago. I can not believe we have this discussion in 2020

baaym 6y ago
I don't tweet much, but when I do I'd love to be able to sign them like I sign my git commits.
- tuxcanfly 6y ago
  We did exactly this for a side project last week: https://github.com/shabda/tweet-signer https://github.com/shabda/tweet-signer At it's core it's just a spec, so feel free to write your own tools! Suggestions for improving the spec welcome. Please use Github issues
tsimionescu 6y ago
Except that the problem isn't the signature itself, it's the required infrastructure. Grandma doesn't know how to check The Donald's signature. And, of course, the infrastructure is hard (just check the unfixable problems with the PGP persistent DOS attacks that were discussed a year or 2 ago).
- jameshart 6y ago
  Twitter knows how to check a signature though.

C1sc0cat 6y ago

As twitter only has about 5k Employees having more than 1k ie over 20% with access like this is shocking and the fact that "j random "contractor" has access even more so. Twitter needs to get serious period and not just blue checks. Also a lot of the other FANG type companies are effectively CNI - I think they need to start properly vetting people and I mean real security clearance possibly including TS

laughinghan 6y ago

pending verification that the blue check mark still applies to the person now in control of that account Why would you want to ever allow an admin to transfer control of a verified account to an unverified person? If you're saying that the account recovery process needs to be at least as secure as the credential that was verified (e.g. email address), then I agree. But I don't think reversion to a "pending" state would ever be desirable, though.

Thorentis 6y ago

This is all very true, assuming that was the purpose of the blue check. But it isn't. It's a status symbol that people also see as adding legitimacy to the tweets of an account.