5 ms·

I don't have the most optimistic outlook for this having any impact, but I really hope this sets a precedent for limiting the use of dark patterns with which co

I don't have the most optimistic outlook for this having any impact, but I really hope this sets a precedent for limiting the use of dark patterns with which companies try to tie your identity to a phone number. I think the total sum for this fine is rather myopic: it ignores the long tail of possible future data leaks and the impact it might have on the people behind the affected accounts. I created my current Twitter account a few years ago and it remained dormant for a while. It was flagged as "in violation of our policies" despite having not made any tweets or using a handle or nickname that would cause offense to anyone. In order to resolve this, I had to enter my phone number to "secure" my account. I don't know what process triggered this review, but I'll be damned if it didn't smell like an easy way to associate an existing marketing profile with my Twitter account. Of course, it's vitally important to profile a service I used to keep up with industry news and post about Goban puzzles. I've also run into similar patterns on Discord and similar platforms; "Oops! Something suspicious is happening with the account [you literally just created]. Please add a phone number to your profile to proceed." Although I follow a reasonable set of practices around identity/password management, I usually architect my risk profile with a "I don't care if I lose this account" approach. If that statement isn't true, then I will happily apply all of the security measures available. However, it seems like the idea of creating "I don't care" accounts is becoming increasingly difficult as we continue to invest in user marketing analytics and lower the barrier of entry to these types of technologies that do not have the consumer's best interests in mind.

pixl97 4y ago
>I created my current Twitter account a few years ago and it remained dormant for a while. It was flagged as "in violation of our policies Same here, linked it to PSN to get images off my PS4 and it was flagged before I could do anything. Never did add my number and shortly after that they had a leak where any hacker could figure your number out.
- travisporter 4y ago
  Same here although after a year of “come back come back!” Emails almost daily (that went straight to spam for some reason) I tried again and got my account working. Seriously twitter- go suck an egg. With so much money, how can you betray trust of your users? I get daily calls from car warranty scams because of stuff like this
c3534l 4y ago
Fines are generally made small enough not to be overturned, so the agency doesn't have to waste money litigating it, while also typically being large enough to change future behavior. They're not really retributive so much a cold calculations meant to get companies to do what they're supposed to do.
- account42 4y ago
  Yet another way in which justice is not blind when it comes to wealth.
- staticassertion 4y ago
  OK, but Twitter is a special case. After the breach the FTC brought charges against Twitter and mandated that the company implement a more robust security program. This should have hurt Twitter way more.
- octagons 4y ago
  That’s a good point - I hadn’t thought of it that way. Thank you!
doctor_eval 4y ago
I tried to create a Facebook account recently to join a group. I used an Apple hide my email address. Within a day or so the account was blocked, and I was required to provide not just my mobile number - but a photo of me. I did try uploading a celebrity photo instead, and of course it didn’t work. But I was shocked at the need to post a photo of myself. That is way past my creepy threshold.
- biglost 4y ago
  Mercadolibre ask for your photo with your id card for both sides Not ask, REQUIRE
  - fersarr 4y ago
    Yea, I hate Mercadolibre for that. And it's even more annoying/impossible to use if you are not a resident or national.
  - metaphor 4y ago
    Not a user, but doesn't MercadoLibre operate as a licensed financial institution in at least a portion of their vertical where such a requirement would not be considered unreasonable? I can certainly see them playing dark pattern games with sensitive privileged data from one business cross-pollinating into unrelated businesses by way of blind user agreement acceptance though. EDIT: From their most recent 10-K filing[1], under Government regulation: In addition, Mercado Pago as a payment institution in Brazil is subject to: ... (iv) Data Protection Law: In August 2018, Brazil approved its first comprehensive data protection law (the “Lei Geral de Proteção de Dados Pessoais” or “LGPD”), which became applicable to our business in Brazil since August 2020. In December 2018, the former president of Brazil issued Provisional Measure No. 869/2018 which amended the LGPD and created Brazil’s national data protection authority (the “ANPDP”). We have created a program to oversee the implementation of relevant changes to our business processes, compliance infrastructures and IT systems to reflect the new requirements and comply with the LGPD. The LGPD establishes detailed rules for the collection, use, processing and storage of personal data and affects all economic sectors, including the relationship between customers and suppliers of goods and services, employees and employers and other relationships in which personal data is collected, whether in a digital or physical environment. (v) Secrecy rules: In addition to regulations affecting payment schemes, Mercado Pago is also subject to laws relating to internet activities and e-commerce, as well as banking secrecy laws, consumer protection laws, tax laws (and related obligations such as the rules governing the sharing of customer information with tax and financial authorities) and other regulations applicable to Brazilian companies generally. Internet activities in Brazil are regulated by Law No. 12,965/2014, known as the Brazilian Civil Rights Framework for the internet, which embodies a substantial set of rights of internet users and obligations relating to internet service providers, including data protection. Law No. 12,865/2013 prohibits payment institutions from performing activities that are restricted to financial institutions, such as granting loans directly. In November 2020, the BACEN approved the application filed by MercadoLibre Inc. for authorization to incorporate a financial institution in the modality of credit, financing and investment corporation (SCFI). In light of the authorization granted by BACEN, we incorporated a new entity (Mercado Crédito Sociedade de Crédito, Financiamento e Investimento S.A.), which operates activities related to the granting of loans and obtains better funding alternatives for our business. ... The BACEN is also implementing the Brazilian Open Banking environment, to enable the sharing of data, products and services between regulated entities — financial institutions, payment institutions and other entities licensed by the BACEN — at the customers' discretion, as far as their own data is concerned (individuals or legal entities). The Open Banking implementation has been gradual, through incremental phases that take into account specific information/services to be shared, and Mercado Pago is a participant of the Open Banking system since February 2021, when its phase 1 started. [1] https://www.sec.gov/Archives/edgar/data/0001099590/000156276222000049/meli-20211231x10k.htm#Item1 https://www.sec.gov/Archives/edgar/data/0001099590/000156276...
leksak 4y ago
I've avoided Facebook vehemently for several years but recently had to get it for a work-thing and seconds after creating it had to supply my mobile number because of something-something suspicious so this is me contributing that anecdata.
- mnd999 4y ago
  Same with discord. “Not giving us enough data” is now suspicious.
kouteiheika 4y ago
> I've also run into similar patterns on Discord and similar platforms; "Oops! Something suspicious is happening with the account [you literally just created]. Please add a phone number to your profile to proceed." This happened to me the other day, but for an account which is years old, owns a server with 1200+ members, and... is already logged into Discord on another web browser. I usually use Firefox for chatting, and Chrome for voice chat (since it works better than FF for that). So I usually have FF permanently open, and I log into Discord through Chrome from time to time to voice chat. So this one time I open up Chrome (while, again, I'm simultaneously logged in through FF and can fully use my account), try to log in, and... I get a "verification required" screen. They allegedly think I'm an abusive user so they're preventing me from logging in into Discord without verifying my account, but they're simultaneously letting me fully use my account? How does this make any sense? Any abuse I can do I can already do because I'm already logged in, from exactly the same computer. I wrote to their support asking what's up with this, and they basically told me they don't care, and that I will be required to verify. Of course they won't tell you why they're doing it, because "security". I regularly receive crypto scam DMs on Discord and they're seemingly unable to block those kinds of accounts, but they sure as hell are good at bullying legitimate users like me.
- stayfrosty420 4y ago
  You can use software 2fa for discord at least
  - kouteiheika 4y ago
    > You can use software 2fa for discord at least They specifically ask for a phone number, and only a phone number.
  - mlindner 4y ago
    Same thing happened to me and it's got nothing to do with 2FA.
benibela 4y ago
I signed up on Twitter and before I could even post anything, I got something like "your account has been banned. Enter your phone number to unban it" It was especially infurating, because I did not have a smartphone, only a land line, and they wanted to send an SMS.

pixl97 4y ago

>I created my current Twitter account a few years ago and it remained dormant for a while. It was flagged as "in violation of our policies Same here, linked it to PSN to get images off my PS4 and it was flagged before I could do anything. Never did add my number and shortly after that they had a leak where any hacker could figure your number out.

travisporter 4y ago
Same here although after a year of “come back come back!” Emails almost daily (that went straight to spam for some reason) I tried again and got my account working. Seriously twitter- go suck an egg. With so much money, how can you betray trust of your users? I get daily calls from car warranty scams because of stuff like this

c3534l 4y ago

Fines are generally made small enough not to be overturned, so the agency doesn't have to waste money litigating it, while also typically being large enough to change future behavior. They're not really retributive so much a cold calculations meant to get companies to do what they're supposed to do.

account42 4y ago
Yet another way in which justice is not blind when it comes to wealth.
staticassertion 4y ago
OK, but Twitter is a special case. After the breach the FTC brought charges against Twitter and mandated that the company implement a more robust security program. This should have hurt Twitter way more.
octagons 4y ago
That’s a good point - I hadn’t thought of it that way. Thank you!

doctor_eval 4y ago

I tried to create a Facebook account recently to join a group. I used an Apple hide my email address. Within a day or so the account was blocked, and I was required to provide not just my mobile number - but a photo of me. I did try uploading a celebrity photo instead, and of course it didn’t work. But I was shocked at the need to post a photo of myself. That is way past my creepy threshold.

biglost 4y ago
Mercadolibre ask for your photo with your id card for both sides Not ask, REQUIRE
- fersarr 4y ago
  Yea, I hate Mercadolibre for that. And it's even more annoying/impossible to use if you are not a resident or national.
- metaphor 4y ago
  Not a user, but doesn't MercadoLibre operate as a licensed financial institution in at least a portion of their vertical where such a requirement would not be considered unreasonable? I can certainly see them playing dark pattern games with sensitive privileged data from one business cross-pollinating into unrelated businesses by way of blind user agreement acceptance though. EDIT: From their most recent 10-K filing[1], under Government regulation: In addition, Mercado Pago as a payment institution in Brazil is subject to: ... (iv) Data Protection Law: In August 2018, Brazil approved its first comprehensive data protection law (the “Lei Geral de Proteção de Dados Pessoais” or “LGPD”), which became applicable to our business in Brazil since August 2020. In December 2018, the former president of Brazil issued Provisional Measure No. 869/2018 which amended the LGPD and created Brazil’s national data protection authority (the “ANPDP”). We have created a program to oversee the implementation of relevant changes to our business processes, compliance infrastructures and IT systems to reflect the new requirements and comply with the LGPD. The LGPD establishes detailed rules for the collection, use, processing and storage of personal data and affects all economic sectors, including the relationship between customers and suppliers of goods and services, employees and employers and other relationships in which personal data is collected, whether in a digital or physical environment. (v) Secrecy rules: In addition to regulations affecting payment schemes, Mercado Pago is also subject to laws relating to internet activities and e-commerce, as well as banking secrecy laws, consumer protection laws, tax laws (and related obligations such as the rules governing the sharing of customer information with tax and financial authorities) and other regulations applicable to Brazilian companies generally. Internet activities in Brazil are regulated by Law No. 12,965/2014, known as the Brazilian Civil Rights Framework for the internet, which embodies a substantial set of rights of internet users and obligations relating to internet service providers, including data protection. Law No. 12,865/2013 prohibits payment institutions from performing activities that are restricted to financial institutions, such as granting loans directly. In November 2020, the BACEN approved the application filed by MercadoLibre Inc. for authorization to incorporate a financial institution in the modality of credit, financing and investment corporation (SCFI). In light of the authorization granted by BACEN, we incorporated a new entity (Mercado Crédito Sociedade de Crédito, Financiamento e Investimento S.A.), which operates activities related to the granting of loans and obtains better funding alternatives for our business. ... The BACEN is also implementing the Brazilian Open Banking environment, to enable the sharing of data, products and services between regulated entities — financial institutions, payment institutions and other entities licensed by the BACEN — at the customers' discretion, as far as their own data is concerned (individuals or legal entities). The Open Banking implementation has been gradual, through incremental phases that take into account specific information/services to be shared, and Mercado Pago is a participant of the Open Banking system since February 2021, when its phase 1 started. [1] https://www.sec.gov/Archives/edgar/data/0001099590/000156276222000049/meli-20211231x10k.htm#Item1 https://www.sec.gov/Archives/edgar/data/0001099590/000156276...

leksak 4y ago

I've avoided Facebook vehemently for several years but recently had to get it for a work-thing and seconds after creating it had to supply my mobile number because of something-something suspicious so this is me contributing that anecdata.

mnd999 4y ago
Same with discord. “Not giving us enough data” is now suspicious.

kouteiheika 4y ago

> I've also run into similar patterns on Discord and similar platforms; "Oops! Something suspicious is happening with the account [you literally just created]. Please add a phone number to your profile to proceed." This happened to me the other day, but for an account which is years old, owns a server with 1200+ members, and... is already logged into Discord on another web browser. I usually use Firefox for chatting, and Chrome for voice chat (since it works better than FF for that). So I usually have FF permanently open, and I log into Discord through Chrome from time to time to voice chat. So this one time I open up Chrome (while, again, I'm simultaneously logged in through FF and can fully use my account), try to log in, and... I get a "verification required" screen. They allegedly think I'm an abusive user so they're preventing me from logging in into Discord without verifying my account, but they're simultaneously letting me fully use my account? How does this make any sense? Any abuse I can do I can already do because I'm already logged in, from exactly the same computer. I wrote to their support asking what's up with this, and they basically told me they don't care, and that I will be required to verify. Of course they won't tell you why they're doing it, because "security". I regularly receive crypto scam DMs on Discord and they're seemingly unable to block those kinds of accounts, but they sure as hell are good at bullying legitimate users like me.

stayfrosty420 4y ago
You can use software 2fa for discord at least
- kouteiheika 4y ago
  > You can use software 2fa for discord at least They specifically ask for a phone number, and only a phone number.
- mlindner 4y ago
  Same thing happened to me and it's got nothing to do with 2FA.

benibela 4y ago

I signed up on Twitter and before I could even post anything, I got something like "your account has been banned. Enter your phone number to unban it" It was especially infurating, because I did not have a smartphone, only a land line, and they wanted to send an SMS.