5 ms·

God Mode, from my understanding, allows a Twitter employee to have access to an account and allows for a post to be made, under that account's id, without the

God Mode, from my understanding, allows a Twitter employee to have access to an account and allows for a post to be made, under that account's id, without the account being notified or seeing the post show up in their own timeline. Is this an accurate statement? If so, why did nearly 1000 employees (12% of the workforce) have access to this mode before it was restricted, and what's the business case for that?

dnakxnc 4y ago
eastbound 4y ago
That explains why some people apologize for things they said would never apologize… Thing is, now that it’s possible for Twitter, Twitter can never brush off this suspicions again. We’re literally not sure, by using Twitter, that we see the speech of that person.
saalweachter 4y ago
Now think about the implications with respect to Twitter DMs that show up in criminal investigations. For instance, consider the Twitter DMs exchanged by Donald Trump, Jr and WikiLeaks. In that particular case, the communication was acknowledged by the party in question, but imagine the two possibilities thousands of employees being able to act on the part of users opens up: 1. Twitter employees could fabricate a criminal conspiracy by creating messages between multiple Twitter accounts. 2. A criminal conspiracy can now use the "Wasn't me, must have been some random Twitter employees" defense.
- bequanna 4y ago
  This seems like a huge win for the defense in a case using DMs or Tweets as evidence. It would be quite easy to argue that a highly-politicized org like Twitter _might_ alter tweets or DMs to implicate someone in the opposing party. That’s reasonable doubt that at least some jurors would buy.
  - saalweachter 4y ago
    Perfidy could still happen in a tightly controlled system, where only a small number of people could view or modify user data, in a way that requires multiple individuals to sign off on it, and both the access and the modifications were internally logged and audited. But that turns into "there was a sizeable conspiracy to fabricate evidence", as opposed to "a random person out of 2000 got bored, had a grudge, decided to have a laugh, and was acting alone".
  - minhazm 4y ago
    Usually these sorts of systems have very detailed logs and those logs are kept for a long time for things like lawsuits. In the hypothetical scenario you're describing the other party would subpoena Twitter and they would corroborate whether or not someone logged as that user or not.
    - robotnikman 4y ago
      From what the article mentions it sounds like Twitter could very well be lacking those detailed logs and checks...
    - jyrkesh 4y ago
      But part of what this article calls out from the whistleblower's POV is that the logging and auditing systems that would be needed to do that don't exist at Twitter. That users can activate God Mode or get into production systems without any logging or accountability
- BeFlatXIII 4y ago
  > A criminal conspiracy can now use the "Wasn't me, must have been some random Twitter employees" defense. I could see this being billed as a feature of a privacy-forward chat platform. Messages are slipped into conversations without either party having actually sent them and no way to tell whether they were real or not.
  - vineyardmike 4y ago
    I’ve heard of similar things to this being discussed… Eg. simple things like tracking-busters where it randomly clicks links in headless chrome to fool the algorithm, p2p vpns where you use a random user’s IP address to randomize who made what request, etc. There is also a school of thought that you should periodically publish private keys for plausible deniability (“was it me, or did someone sign that after I published the key”).
    - BeFlatXIII 4y ago
      Long live deliberate incompetence! Let's fill the world with a cloud of uncertainty.
      - vineyardmike 4y ago
        It’s deliberate plausible deniability.
- MuffinFlavored 4y ago
  > 1. Twitter employees could fabricate a criminal conspiracy by creating messages between multiple Twitter accounts. Could be thwarted by some kind of "source" database column/field/value that says "this is a tweet made by God mode" Whether Twitter has that field, if it is internal only, and if they would share it with the public/a court of law, I have no clue
  - saalweachter 4y ago
    Yeah, at the bare minimum what you want to see is: 1. No employees have direct, immediate access to user accounts or data. 2. Only a small number of employees should ever be able to gain access to user accounts or data, for the purpose of resolving issues directly affecting said accounts or data. 3. Access is only granted to one specific user account at a time, and only for a limited amount of time. 4. Access to a user account requires at least one other person to sign off on the access-grant. 5. Every operation performed upon a user account -- viewing a field, modifying a field -- is logged in a place the people from #2 and #4 do not have access to. 6. Access logs are routinely audited for perfidy. 7. Gaining accesses to user accounts or interacting with them in a way that is not necessary or attempting to circumvent the above process must be a don't-bother-cleaning-out-your-desk-we'll-do-it-for-you offense. With policies in place like that, you reduce the insider risk to user accounts. You need multiple people directly involved in secretly accessing or taking over a user account, and you potentially need dozens of others (the potential auditors) to be complicit. The more people you have involved, the more likely it is someone shuts it down, or at least blows the whistle on it when shit hits the fan. If someone can just get drunk one night, open up a user account, tweet something, then SSH over to the audit server and drop the rows from the access log indicating what they did, and there's no way to even prove something happened, let alone who did it.
dbbk 4y ago
What scenario would justify that feature existing though? Why would they need to make posts from arbitrary accounts?
- bombcar 4y ago
  It's common in lots of software - a form of a "su" command that lets you assume all aspects of a particular user. Usually developed for testing purposes (easiest way to reproduce a problem, after all) and prevents password-sharing. But it can obviously be used for evil, and so it should be heavily logged and flagged.
  - deleted 4y ago
    [deleted]
  - ALittleLight 4y ago
    But the comment says that users wouldn't even see posts from the Twitter employee assuming their account in their own timeline. What legitimate purpose would that serve?
    - bombcar 4y ago
      I would assume some kind of "don't disturb the user while testing" but if everyone else sees them ...
      - jasonm23 4y ago
        Why would this be a production data "tool"? Makes no sense at all unless Twitter DGAF about it's users privacy... Ok, answered my own question there didn't I.
  - jasonm23 4y ago
    I worked in finance and we are brick-walled from real production data. There's obviously a way around it, but it is not a function you can pull out the company toolbox. This is a clear breach of infosec if there's a $#%*# su to post as Waldo and Waldo can't see that post. In fact it seems ONLY possible to do _evil_ with that feature.
ntonozzi 4y ago
If you read the document "Security Chief's Final Report to Twitter" on the Washington Post article (https://www.washingtonpost.com/technology/interactive/2022/twitter-whistleblower-sec-spam/ https://www.washingtonpost.com/technology/interactive/2022/t...), you will see that 'god mode' just means they have IPMI access to servers.
- modeless 4y ago
  "just"? What percentage of Google engineers do you think have IPMI access to servers?
  - ntonozzi 4y ago
    Yeah I’m not sure the “just” is justified, and it’s not good but it’s certainly different than being able to send tweets as a particular user. IPMI access was typically only given to SREs.
- shrubble 4y ago
  The previous "God Mode" worked as I said. I think prior to 2020 when the Bitcoin hacks occurred against Twitter users.

dnakxnc 4y ago

eastbound 4y ago

That explains why some people apologize for things they said would never apologize… Thing is, now that it’s possible for Twitter, Twitter can never brush off this suspicions again. We’re literally not sure, by using Twitter, that we see the speech of that person.

saalweachter 4y ago

Now think about the implications with respect to Twitter DMs that show up in criminal investigations. For instance, consider the Twitter DMs exchanged by Donald Trump, Jr and WikiLeaks. In that particular case, the communication was acknowledged by the party in question, but imagine the two possibilities thousands of employees being able to act on the part of users opens up: 1. Twitter employees could fabricate a criminal conspiracy by creating messages between multiple Twitter accounts. 2. A criminal conspiracy can now use the "Wasn't me, must have been some random Twitter employees" defense.

bequanna 4y ago
This seems like a huge win for the defense in a case using DMs or Tweets as evidence. It would be quite easy to argue that a highly-politicized org like Twitter _might_ alter tweets or DMs to implicate someone in the opposing party. That’s reasonable doubt that at least some jurors would buy.
- saalweachter 4y ago
  Perfidy could still happen in a tightly controlled system, where only a small number of people could view or modify user data, in a way that requires multiple individuals to sign off on it, and both the access and the modifications were internally logged and audited. But that turns into "there was a sizeable conspiracy to fabricate evidence", as opposed to "a random person out of 2000 got bored, had a grudge, decided to have a laugh, and was acting alone".
- minhazm 4y ago
  Usually these sorts of systems have very detailed logs and those logs are kept for a long time for things like lawsuits. In the hypothetical scenario you're describing the other party would subpoena Twitter and they would corroborate whether or not someone logged as that user or not.
  - robotnikman 4y ago
    From what the article mentions it sounds like Twitter could very well be lacking those detailed logs and checks...
  - jyrkesh 4y ago
    But part of what this article calls out from the whistleblower's POV is that the logging and auditing systems that would be needed to do that don't exist at Twitter. That users can activate God Mode or get into production systems without any logging or accountability
BeFlatXIII 4y ago
> A criminal conspiracy can now use the "Wasn't me, must have been some random Twitter employees" defense. I could see this being billed as a feature of a privacy-forward chat platform. Messages are slipped into conversations without either party having actually sent them and no way to tell whether they were real or not.
- vineyardmike 4y ago
  I’ve heard of similar things to this being discussed… Eg. simple things like tracking-busters where it randomly clicks links in headless chrome to fool the algorithm, p2p vpns where you use a random user’s IP address to randomize who made what request, etc. There is also a school of thought that you should periodically publish private keys for plausible deniability (“was it me, or did someone sign that after I published the key”).
  - BeFlatXIII 4y ago
    Long live deliberate incompetence! Let's fill the world with a cloud of uncertainty.
    - vineyardmike 4y ago
      It’s deliberate plausible deniability.
MuffinFlavored 4y ago
> 1. Twitter employees could fabricate a criminal conspiracy by creating messages between multiple Twitter accounts. Could be thwarted by some kind of "source" database column/field/value that says "this is a tweet made by God mode" Whether Twitter has that field, if it is internal only, and if they would share it with the public/a court of law, I have no clue
- saalweachter 4y ago
  Yeah, at the bare minimum what you want to see is: 1. No employees have direct, immediate access to user accounts or data. 2. Only a small number of employees should ever be able to gain access to user accounts or data, for the purpose of resolving issues directly affecting said accounts or data. 3. Access is only granted to one specific user account at a time, and only for a limited amount of time. 4. Access to a user account requires at least one other person to sign off on the access-grant. 5. Every operation performed upon a user account -- viewing a field, modifying a field -- is logged in a place the people from #2 and #4 do not have access to. 6. Access logs are routinely audited for perfidy. 7. Gaining accesses to user accounts or interacting with them in a way that is not necessary or attempting to circumvent the above process must be a don't-bother-cleaning-out-your-desk-we'll-do-it-for-you offense. With policies in place like that, you reduce the insider risk to user accounts. You need multiple people directly involved in secretly accessing or taking over a user account, and you potentially need dozens of others (the potential auditors) to be complicit. The more people you have involved, the more likely it is someone shuts it down, or at least blows the whistle on it when shit hits the fan. If someone can just get drunk one night, open up a user account, tweet something, then SSH over to the audit server and drop the rows from the access log indicating what they did, and there's no way to even prove something happened, let alone who did it.

dbbk 4y ago

What scenario would justify that feature existing though? Why would they need to make posts from arbitrary accounts?

bombcar 4y ago
It's common in lots of software - a form of a "su" command that lets you assume all aspects of a particular user. Usually developed for testing purposes (easiest way to reproduce a problem, after all) and prevents password-sharing. But it can obviously be used for evil, and so it should be heavily logged and flagged.
- deleted 4y ago
  [deleted]
- ALittleLight 4y ago
  But the comment says that users wouldn't even see posts from the Twitter employee assuming their account in their own timeline. What legitimate purpose would that serve?
  - bombcar 4y ago
    I would assume some kind of "don't disturb the user while testing" but if everyone else sees them ...
    - jasonm23 4y ago
      Why would this be a production data "tool"? Makes no sense at all unless Twitter DGAF about it's users privacy... Ok, answered my own question there didn't I.
- jasonm23 4y ago
  I worked in finance and we are brick-walled from real production data. There's obviously a way around it, but it is not a function you can pull out the company toolbox. This is a clear breach of infosec if there's a $#%*# su to post as Waldo and Waldo can't see that post. In fact it seems ONLY possible to do _evil_ with that feature.

ntonozzi 4y ago

If you read the document "Security Chief's Final Report to Twitter" on the Washington Post article (https://www.washingtonpost.com/technology/interactive/2022/twitter-whistleblower-sec-spam/ https://www.washingtonpost.com/technology/interactive/2022/t...), you will see that 'god mode' just means they have IPMI access to servers.

modeless 4y ago
"just"? What percentage of Google engineers do you think have IPMI access to servers?
- ntonozzi 4y ago
  Yeah I’m not sure the “just” is justified, and it’s not good but it’s certainly different than being able to send tweets as a particular user. IPMI access was typically only given to SREs.
shrubble 4y ago
The previous "God Mode" worked as I said. I think prior to 2020 when the Bitcoin hacks occurred against Twitter users.