4 ms·

verified ones rank higher in comments and look more authoritative.

aww_dang 6y ago
Sure, but if you are going to automate the whole thing, 100 accounts might be just as good as 1 verified. Interesting that they bother to get the verified accounts. Could be they're just going after just a large volume of accounts that they find themselves with some verified and some non-verified. I suspect new account generation is locked down tighter than the method they're using to take over these accounts. Note the generated replies. Some of them are completely off-topic.
- hamiltonians 6y ago
  The automation is in the harvesting of accounts, which I still have little idea how they are getting so many, although I am looking into it deeper. They are possibly able to scrape a huge list of verified accounts and then bruteforce it, possibly with an AWS cluster to prevent rate limiting by having access to large pools of IPs. Likely they have a list of 1000+ accounts they go through each one with a simple password, the same password for each account, and then work their way up to strings of numbers, words, and other characters. The posting process is not automated though. Verified accounts do not get filtered as easily if you change the profile pic. Notice how it changed it to Chamath, but without a verified account, likely twitter's algos would ghost any posts made by the account or suspend it. Upon gross inspection it really does look like the real Chamath, hence why it is so effective.
  - aww_dang 6y ago
    The easiest, least specialized route would be for them to simply buy the account credentials. Socks5 residential proxies are similarly sold in the same place. As are password dumps. In the case of password reuse, I believe Twitter may still provide a way to find users by email address. Therefore, if the user's email and password are known, then the user's Twitter account can be found. From there a login can be attempted. There could also be a malicious mobile app for account hijacking. Regardless, they could most probably buy the Twitter accounts.

Sure, but if you are going to automate the whole thing, 100 accounts might be just as good as 1 verified. Interesting that they bother to get the verified accounts. Could be they're just going after just a large volume of accounts that they find themselves with some verified and some non-verified. I suspect new account generation is locked down tighter than the method they're using to take over these accounts. Note the generated replies. Some of them are completely off-topic.

hamiltonians 6y ago
The automation is in the harvesting of accounts, which I still have little idea how they are getting so many, although I am looking into it deeper. They are possibly able to scrape a huge list of verified accounts and then bruteforce it, possibly with an AWS cluster to prevent rate limiting by having access to large pools of IPs. Likely they have a list of 1000+ accounts they go through each one with a simple password, the same password for each account, and then work their way up to strings of numbers, words, and other characters. The posting process is not automated though. Verified accounts do not get filtered as easily if you change the profile pic. Notice how it changed it to Chamath, but without a verified account, likely twitter's algos would ghost any posts made by the account or suspend it. Upon gross inspection it really does look like the real Chamath, hence why it is so effective.
- aww_dang 6y ago
  The easiest, least specialized route would be for them to simply buy the account credentials. Socks5 residential proxies are similarly sold in the same place. As are password dumps. In the case of password reuse, I believe Twitter may still provide a way to find users by email address. Therefore, if the user's email and password are known, then the user's Twitter account can be found. From there a login can be attempted. There could also be a malicious mobile app for account hijacking. Regardless, they could most probably buy the Twitter accounts.