5 ms·

Twitter stores original account names, dox vulnerability via Twitter Spaces

129 points by steelstraw 5y ago

deleted 5y ago
[deleted]
smashah 5y ago
There's a mass systematic bulldozing/demolition of whole lower/working class neighborhoods happening in Jeddah, Saudi Arabia right now. Locals use Twitter spaces extensively to discuss, organize and share stories. Twitter spaces needs to have a way to join in in discussions anonymously to say the least. Please give users options around their own risk profile - including voice modulation.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- AustinDev 5y ago
  But what about the trolls?
  - tata71 5y ago
    People will leave their Spaces...like always.
- BiteCode_dev 5y ago
  Using twitter, a proprietary, non e2e encrypted, for profit platform with an history of political meddling and censorship to organize social change seems a dangerous bet to me. This is basically hoping that: - they are willing to play nice with you - they won't get pressured into not playing nice with you - nobody will use technical means to extract things from them Meanwhile, while taking this bet, those people are creating a gigantic data graph of persons, backed by detailed twitter tracking, all enriched by tons of evidences of their action, thinking and desired in the form of messages. So if the big guys want to hit them after that, they can grab this juicy data set and have a blast.
  - smashah 5y ago
    These are everyday simple people, not HN people. They're not thinking about spinning up a matrix server with tailscale while a bulldozer is ploughing through their home. If the people go to twitter then twitter needs to consider their circumstances and accommodate.
    - BiteCode_dev 5y ago
      Twitter doesn't need to do anything. It's a for profit private company, not an NGO. It's not a water company, it doesn't have legally a duty to its clients. It will do what is good for twitter. I guess the lesson will be learned by paying a heavy price again and again until it sticks.
      - smashah 5y ago
        NGOs also don't need to do anything. Nobody has to do anything. You don't have to reply to my comments. I don't need to reply to yours. I don't need to explain simple corporate responsibility to not enable dictatorships to easily target people to you. I'm not an NGO. I guess the lesson that I've learnt is that there's always a gormless oddball on HN that attempts to instigate an irrelevant argument. Unfortunately, it's a heavy price I continue to pay. Hasn't stuck yet :(
        BiteCode_dev 5y ago
        There is no need for insults. The argument is only irrelevant if you consider the matter solved. But it's not. You still think "Twitter should do something", like if 30 years of big IT corporation behavior history hasn't proven it's wishful thinking. What we need is keeping educating people to not use those platforms for anything that requires privacy, to not give all their data to GAFAM and make safe systems more user friendly and ubiquitous. So that it doesn't stay in the HN bubble. This is not wishful thinking, as people around me are asking me more and more about privacy. Last month, my little bro told me to switch to encrypted channels to talk to him, for something I though was overkill. He is not in IT. It's a slow process, but so is teaching everyone to read. In that regards, having such argument is a good thing, since that, even in HN, it's a healthy way to discussing between people tech saavy what we could prioritize as a community. I assume, that, since we are discussing it, some of us are interested in the problem and our role in it.
riffic 5y ago
I love that there's a third-party collecting Twitter bugs (one of the replies in the linked Tweet): https://github.com/simonsarris/Twitter-Bugs https://github.com/simonsarris/Twitter-Bugs Twitter sure as hell doesn't pay attention to bug reports filed by their own users. You want to test this assumption? Tell me how you're supposed to open a bug report as a user.
- deleted 5y ago
  [deleted]
- mintplant 5y ago
  It starts with being some kind of celebrity or monetizable public figure. Twitter has long baked class stratification into the platform. Verified ticks are the most visible user-facing aspect of that, but there are multiple levels of advanced toolsets, features, and access made available to VIP accounts.
- patcon 5y ago
  Seems maybe inspired by this: https://github.com/isaacs/github https://github.com/isaacs/github Was a great resource (and place to vent with like-minded users) before GitHub finally conceded and created a public issue tracking system of sorts <3
- saagarjha 5y ago
  Not to give Twitter a pass for this kind of thing, but isn’t this basically par for the course for most web services? Where do you file a bug report for Facebook? Or Whole Foods?
- Cthulhu_ 5y ago
  That's because they would get flooded by bug reports, like how right now they get flooded with people flagging accounts and tweets (brigades) and I'm sure there's more engineering effort going into automating that system than, say, Spaces or Twitter's primary experience.
jakub_g 5y ago
I recently came across this while searching for some old discussions / retweets and found a tweet by someone who I know changed their handle; after clicking RT/QT/reply (don't remember) somewhere in the thread, I saw a form to reply to both their old and new handle.
- kevingadd 5y ago
  This is likely because some replies include the username as text inside of the tweet, you run across it with tweets that are old enough if any of the conversation participants did a nick change. This also means that if an account is deleted or renamed and then later someone claims the old name, it will look like the tweet was replying to them when it was really in reply to someone else. I think for modern tweets the reply-to is stored in a different way so that it doesn't count against the length limit and is only shown in the replying-to bits of the UI, but I'm not sure precisely how it works.
noelrock 5y ago
Not at all the same issue but vaguely relevant — I like the idea of ambiently joining some Twitter spaces without feeling obliged to contribute. Would strike me as a decent trade off that non contributors should be able to join anonymously. Whenever I’ve joined something in my specific area to date, I’m called on to contribute maybe half the time by the host - which is generally fine and I’m happy to, but sometimes you’re not able to… so it puts you off joining altogether.
- steelstraw 5y ago
  That might be making it harder for smaller rooms to grow, if there's a lot of users less likely to join because of that. Whereas in big rooms you disappear in the crowd.
WA 5y ago
This might be an annoying bug, but I wouldn't call this a doxxing vulnerability. Your userid stays the same, no matter what your handle is. Of course, the userid is mostly hidden for the end user, but there are a few services that track changing handles by referencing the userid. So you could be doxxed all the time anyways. Now it is just a bit more obvious.
- Cthulhu_ 5y ago
  The internet is permanent, and if Twitter themselves don't remember a display name you used to use, 3rd party services will. If you need to erase your old identity, it's best to create a new account and use your right to be forgotten to have Twitter delete your old stuff. And while the GDPR and the like mandate how that SHOULD work, you can't trust that it WILL work.
  - iszomer 5y ago
    Twitter seems to obfuscates recycled username creation dates too. I deleted an OG account from 2008 last year and now I see someone has claimed it but it's join date is from 2018.
- shrikant 5y ago
  If you create a Twitter List and add users into it, they stay in the list even if/when they change their handles. I used this approach to keep track of scammers a while back when Twitter DM scams were a thing amongst the circles I was following.
m4tthumphrey 5y ago
Off topic: Since when did Twitter force logging in to view the site?
- MildlySerious 5y ago
  This has been a slow process for about two years now I think, and has recently gotten a lot worse. In the past, Twitter would sometimes show errors instead of tweets when not logged in. My assumption at the time was that they were prioritizing logged in users during high traffic hours, but who knows. Then they required you to log in when trying to view the media tab on profiles, and from there it sort of snowballed into its current state, where you can scroll down a couple tweets and then get the full Pinterest experience.
- riffic 5y ago
  Around August, at least that's when the complaints seemed to start flooding in: https://www.google.com/search?q=twitter+login+wall+site:news.ycombinator.com https://www.google.com/search?q=twitter+login+wall+site:news...

129 points by steelstraw 5y ago

deleted 5y ago

[deleted]

There's a mass systematic bulldozing/demolition of whole lower/working class neighborhoods happening in Jeddah, Saudi Arabia right now. Locals use Twitter spaces extensively to discuss, organize and share stories. Twitter spaces needs to have a way to join in in discussions anonymously to say the least. Please give users options around their own risk profile - including voice modulation.

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
AustinDev 5y ago
But what about the trolls?
- tata71 5y ago
  People will leave their Spaces...like always.
BiteCode_dev 5y ago
Using twitter, a proprietary, non e2e encrypted, for profit platform with an history of political meddling and censorship to organize social change seems a dangerous bet to me. This is basically hoping that: - they are willing to play nice with you - they won't get pressured into not playing nice with you - nobody will use technical means to extract things from them Meanwhile, while taking this bet, those people are creating a gigantic data graph of persons, backed by detailed twitter tracking, all enriched by tons of evidences of their action, thinking and desired in the form of messages. So if the big guys want to hit them after that, they can grab this juicy data set and have a blast.
- smashah 5y ago
  These are everyday simple people, not HN people. They're not thinking about spinning up a matrix server with tailscale while a bulldozer is ploughing through their home. If the people go to twitter then twitter needs to consider their circumstances and accommodate.
  - BiteCode_dev 5y ago
    Twitter doesn't need to do anything. It's a for profit private company, not an NGO. It's not a water company, it doesn't have legally a duty to its clients. It will do what is good for twitter. I guess the lesson will be learned by paying a heavy price again and again until it sticks.
    - smashah 5y ago
      NGOs also don't need to do anything. Nobody has to do anything. You don't have to reply to my comments. I don't need to reply to yours. I don't need to explain simple corporate responsibility to not enable dictatorships to easily target people to you. I'm not an NGO. I guess the lesson that I've learnt is that there's always a gormless oddball on HN that attempts to instigate an irrelevant argument. Unfortunately, it's a heavy price I continue to pay. Hasn't stuck yet :(
      - BiteCode_dev 5y ago
        There is no need for insults. The argument is only irrelevant if you consider the matter solved. But it's not. You still think "Twitter should do something", like if 30 years of big IT corporation behavior history hasn't proven it's wishful thinking. What we need is keeping educating people to not use those platforms for anything that requires privacy, to not give all their data to GAFAM and make safe systems more user friendly and ubiquitous. So that it doesn't stay in the HN bubble. This is not wishful thinking, as people around me are asking me more and more about privacy. Last month, my little bro told me to switch to encrypted channels to talk to him, for something I though was overkill. He is not in IT. It's a slow process, but so is teaching everyone to read. In that regards, having such argument is a good thing, since that, even in HN, it's a healthy way to discussing between people tech saavy what we could prioritize as a community. I assume, that, since we are discussing it, some of us are interested in the problem and our role in it.

riffic 5y ago

I love that there's a third-party collecting Twitter bugs (one of the replies in the linked Tweet): https://github.com/simonsarris/Twitter-Bugs https://github.com/simonsarris/Twitter-Bugs Twitter sure as hell doesn't pay attention to bug reports filed by their own users. You want to test this assumption? Tell me how you're supposed to open a bug report as a user.

deleted 5y ago
[deleted]
mintplant 5y ago
It starts with being some kind of celebrity or monetizable public figure. Twitter has long baked class stratification into the platform. Verified ticks are the most visible user-facing aspect of that, but there are multiple levels of advanced toolsets, features, and access made available to VIP accounts.
patcon 5y ago
Seems maybe inspired by this: https://github.com/isaacs/github https://github.com/isaacs/github Was a great resource (and place to vent with like-minded users) before GitHub finally conceded and created a public issue tracking system of sorts <3
saagarjha 5y ago
Not to give Twitter a pass for this kind of thing, but isn’t this basically par for the course for most web services? Where do you file a bug report for Facebook? Or Whole Foods?
Cthulhu_ 5y ago
That's because they would get flooded by bug reports, like how right now they get flooded with people flagging accounts and tweets (brigades) and I'm sure there's more engineering effort going into automating that system than, say, Spaces or Twitter's primary experience.

jakub_g 5y ago

I recently came across this while searching for some old discussions / retweets and found a tweet by someone who I know changed their handle; after clicking RT/QT/reply (don't remember) somewhere in the thread, I saw a form to reply to both their old and new handle.

kevingadd 5y ago
This is likely because some replies include the username as text inside of the tweet, you run across it with tweets that are old enough if any of the conversation participants did a nick change. This also means that if an account is deleted or renamed and then later someone claims the old name, it will look like the tweet was replying to them when it was really in reply to someone else. I think for modern tweets the reply-to is stored in a different way so that it doesn't count against the length limit and is only shown in the replying-to bits of the UI, but I'm not sure precisely how it works.

noelrock 5y ago

Not at all the same issue but vaguely relevant — I like the idea of ambiently joining some Twitter spaces without feeling obliged to contribute. Would strike me as a decent trade off that non contributors should be able to join anonymously. Whenever I’ve joined something in my specific area to date, I’m called on to contribute maybe half the time by the host - which is generally fine and I’m happy to, but sometimes you’re not able to… so it puts you off joining altogether.

steelstraw 5y ago
That might be making it harder for smaller rooms to grow, if there's a lot of users less likely to join because of that. Whereas in big rooms you disappear in the crowd.

WA 5y ago

This might be an annoying bug, but I wouldn't call this a doxxing vulnerability. Your userid stays the same, no matter what your handle is. Of course, the userid is mostly hidden for the end user, but there are a few services that track changing handles by referencing the userid. So you could be doxxed all the time anyways. Now it is just a bit more obvious.

Cthulhu_ 5y ago
The internet is permanent, and if Twitter themselves don't remember a display name you used to use, 3rd party services will. If you need to erase your old identity, it's best to create a new account and use your right to be forgotten to have Twitter delete your old stuff. And while the GDPR and the like mandate how that SHOULD work, you can't trust that it WILL work.
- iszomer 5y ago
  Twitter seems to obfuscates recycled username creation dates too. I deleted an OG account from 2008 last year and now I see someone has claimed it but it's join date is from 2018.
shrikant 5y ago
If you create a Twitter List and add users into it, they stay in the list even if/when they change their handles. I used this approach to keep track of scammers a while back when Twitter DM scams were a thing amongst the circles I was following.

m4tthumphrey 5y ago

Off topic: Since when did Twitter force logging in to view the site?

MildlySerious 5y ago
This has been a slow process for about two years now I think, and has recently gotten a lot worse. In the past, Twitter would sometimes show errors instead of tweets when not logged in. My assumption at the time was that they were prioritizing logged in users during high traffic hours, but who knows. Then they required you to log in when trying to view the media tab on profiles, and from there it sort of snowballed into its current state, where you can scroll down a couple tweets and then get the full Pinterest experience.
riffic 5y ago
Around August, at least that's when the complaints seemed to start flooding in: https://www.google.com/search?q=twitter+login+wall+site:news.ycombinator.com https://www.google.com/search?q=twitter+login+wall+site:news...