5 ms·

> Sebastian double-checked the verification logo next to Elon Musk's name, and then tried to decide whether to send five or 10 Bitcoin. This is a vulnerability

by paulgb 6y ago

> Sebastian double-checked the verification logo next to Elon Musk's name, and then tried to decide whether to send five or 10 Bitcoin. This is a vulnerability in Twitter's verification policy that Twitter refuses to fix. Originally, verification was supposed to mean "this person is who they say they are". But once an account is verified, you can change the name/profile picture to someone else. So hackers get access to minor verified accounts, change the profile to match Elon, and then they have a "verified" Elon Musk account to scam with. Twitter could fix this tomorrow by requiring that verification be tied to the name you got verified with, and if you do need to change your name you go through an (expedited) re-verification process. That doesn't seem like a lot to ask considering what "verification" is supposed to mean, and what (as evidenced by this article) users of the site take it to mean.

melomal 6y ago
For about $1000 you can get Instagram and Facebook verified accounts so I imagine Twitter is even cheaper/easier to do so.
- candiodari 6y ago
  Since the problem here is that twitter got hacked, this would not have helped at all. The bitcoin scam messages were sent on the "real" account.
cosmodisk 6y ago
This won't solve it because a lot of scams rely on victim's greed,as was the case for the German in this story. This is no different from a scam I saw a few years ago,where some German tourist kept pouring money on a three cup game despite his wife's attempts to stop it. It took him less than 5 minutes to leave nearly €500. It's always the same: you think you are about to get something for nothing. I very much doubt there's a fix for it.
- John23832 6y ago
  The article says that he checked for a check to verify that it was Elon running the account. Sure, greed motivates people, but in this case greed would not have motivated him to continue if he saw that the account was not verified and not Elon’s. If anything the check provided him with the confidence to continue more than anything else.
  - shawnz 6y ago
    Even if the account literally was Elon Musk's real account (i.e. if he were hacked for example), nothing but greed could make someone fall for this
    - John23832 6y ago
      I think boiling this down to greed is oversimplifying the situation and total ignores the effect that this obvious loophole within Twitter had in exacerbating the issue.
  - cosmodisk 6y ago
    I understand he tried to verify it's really Elon, however it still falls under 'something for nothing' category,so it's just different shade of greed.In fact most scams can be put into only a handful categories,such as greed, wanting to help, seeking love,etc.
    - John23832 6y ago
      I agree it was a scam that plays on the emotions of others, but that doesn’t mean that this obvious loophole in twitters verification/name change system didn’t enable the scam as well.
mojuba 6y ago
I think the verification badge should do something else on top of just being shown. Some sort of a PKI trust system like with SSL certs that would point to a specific (possibly masked) email or web site that belongs to the person. In other words I want to know if this is Bill Evans the pianist, not Bill Evans the saxophonist or any other Bill Evans who is not even a musician or someone pretending to be one of them. Can social networks solve this? (I know, Bill Evans the pianist died a long time ago. Big fan of him)
philk10 6y ago
The image in the article shows that the scammer has the twitter name @JoshyMcb so Sebastian didn't check too much
notahacker 6y ago
I agree with your policy recommendation, but I still think people who don't pay enough attention to the possibility "E l o n M u s k" a.k.a "JoshyMcB" might not be the real deal when it's their life savings rather than a retweet on the line have to take the lion's share of the blame. And tbh people shouldn't be trusting even the verified real account on something like this, given it's been hacked to push this exact scam before, and even under the control of actual Elon it tweets about imaginary investors taking TSLA to $420 and other stuff he thinks is funny at the time.
- paulgb 6y ago
  I fully agree. To be sure, I don’t think Twitter deserves the blame here for some pretty weak due diligence on the part of someone transferring six figures. But I think it’s a good policy to begin with that may have prevented this particular instance.

by paulgb 6y ago

melomal 6y ago

For about $1000 you can get Instagram and Facebook verified accounts so I imagine Twitter is even cheaper/easier to do so.

candiodari 6y ago
Since the problem here is that twitter got hacked, this would not have helped at all. The bitcoin scam messages were sent on the "real" account.

cosmodisk 6y ago

This won't solve it because a lot of scams rely on victim's greed,as was the case for the German in this story. This is no different from a scam I saw a few years ago,where some German tourist kept pouring money on a three cup game despite his wife's attempts to stop it. It took him less than 5 minutes to leave nearly €500. It's always the same: you think you are about to get something for nothing. I very much doubt there's a fix for it.

John23832 6y ago
The article says that he checked for a check to verify that it was Elon running the account. Sure, greed motivates people, but in this case greed would not have motivated him to continue if he saw that the account was not verified and not Elon’s. If anything the check provided him with the confidence to continue more than anything else.
- shawnz 6y ago
  Even if the account literally was Elon Musk's real account (i.e. if he were hacked for example), nothing but greed could make someone fall for this
  - John23832 6y ago
    I think boiling this down to greed is oversimplifying the situation and total ignores the effect that this obvious loophole within Twitter had in exacerbating the issue.
- cosmodisk 6y ago
  I understand he tried to verify it's really Elon, however it still falls under 'something for nothing' category,so it's just different shade of greed.In fact most scams can be put into only a handful categories,such as greed, wanting to help, seeking love,etc.
  - John23832 6y ago
    I agree it was a scam that plays on the emotions of others, but that doesn’t mean that this obvious loophole in twitters verification/name change system didn’t enable the scam as well.

mojuba 6y ago

I think the verification badge should do something else on top of just being shown. Some sort of a PKI trust system like with SSL certs that would point to a specific (possibly masked) email or web site that belongs to the person. In other words I want to know if this is Bill Evans the pianist, not Bill Evans the saxophonist or any other Bill Evans who is not even a musician or someone pretending to be one of them. Can social networks solve this? (I know, Bill Evans the pianist died a long time ago. Big fan of him)

philk10 6y ago

The image in the article shows that the scammer has the twitter name @JoshyMcb so Sebastian didn't check too much

notahacker 6y ago

I agree with your policy recommendation, but I still think people who don't pay enough attention to the possibility "E l o n M u s k" a.k.a "JoshyMcB" might not be the real deal when it's their life savings rather than a retweet on the line have to take the lion's share of the blame. And tbh people shouldn't be trusting even the verified real account on something like this, given it's been hacked to push this exact scam before, and even under the control of actual Elon it tweets about imaginary investors taking TSLA to $420 and other stuff he thinks is funny at the time.

paulgb 6y ago
I fully agree. To be sure, I don’t think Twitter deserves the blame here for some pretty weak due diligence on the part of someone transferring six figures. But I think it’s a good policy to begin with that may have prevented this particular instance.