4 ms·

The issued subpoena requires X to share information sufficient to identify the person behind the account. This includes names, addresses, telephone numbers, ema

by dfxm12 6mo ago

The issued subpoena requires X to share information sufficient to identify the person behind the account. This includes names, addresses, telephone numbers, email addresses, account numbers, IP addresses, and any other contact or billing records held by the platform. Taking TF's reporting at face value, would twitter be able to sufficiently identify a user? Does Twitter have the address, real names, etc. of its users?

landl0rd 6mo ago
Twitter has IP addresses at the very least. HBO will then subpoena the account's ISP. If the account had the checkmark pro plan or whatever it's called, it may have or be able to obtain legal name and address for payment details, or its payment processor (Stripe I think) would.
- ronsor 6mo ago
  And all of this falls apart if you use Mullvad, who will be happy to fax HBO lawyers a blank sheet of paper.
  - landl0rd 6mo ago
    At which point twitter will probably yell at you to "verify" with a phone number or something else tied to your government name. Yes you could probably go get a prepaid SIM for cash (depending on your country, many now ban this though America doesn't) but very few people bother with it. Or they just lock your account and demand your ID which I think they now sometimes do.
    - ronsor 6mo ago
      You can pay $5 for a verification phone number. It's not hard.
      - madars 6mo ago
        There are so many more ways one could screw up, and you only need to screw up once. For example, does X do browser fingerprinting and did you ever use similar setup to use a more identifiable Twitter account? Are you using unique phrasings or behavioral patterns? These things can be solved to a satisfactory degree, but I don't think "it's not hard" captures it - for an average user it _is_ hard.
        fc417fc802 6mo ago
        > Are you using unique phrasings or behavioral patterns? Why would Twitter voluntarily run that sort of query to satisfy a subpoena? Whether it's difficult and risky for the average user depends on the threat model. "Twitter doesn't directly have my name, address, or phone number sitting in their database next to my account" is easy. Other things are more difficult.
        madars 6mo ago
        Phrasing idiosyncrasies are publicly observable and anyone can note - as external observers did in Kaczynski or Hanssen cases - that a particular phrasing is quaint. It is probably true that Twitter is unlikely to run a browser fingerprinting query to de-anonymize someone tweeting spoilers from a softcore porn show. But a potential leaker has to ask: "how sure am I of that?"
  - petcat 6mo ago
    > all of this falls apart if you use Mullvad The only thing that falls apart is the IP address identification, which is only a very small signal for identifying an internet user. X/Twitter undoubtedly has more identity information than just an IP address.
  - autoexec 6mo ago
    Doesn't matter if the device you used phoned home with your IP address and any kind of identifier. Your OS that sends telemetry every 7 seconds, a windows update check, another tab with a social media account open. It's easy to cross reference that stuff and figure out what a person's regular ISP is. Almost nobody uses a VPN 100% of the time and at the router (because your OS will phone home before you desktop finishes loading).
    - fc417fc802 6mo ago
      Twitter won't have your various device IDs and VPN IPs are typically shared among many clients simultaneously. You could certainly generate a suspect list but I don't think you'll get conclusive evidence. That said I don't know how much browser fingerprinting Twitter might be doing and if fingerprints from other services might be possible to crossreference. Much higher risk is probably visiting other sites both with and without the VPN using the same browser without thinking about it and thus leaking your fingerprint or even account cookies that way. Or if you don't run a filter then visiting a site without the VPN that embeds Twitter tracking assets would leak to them directly.
      - autoexec 6mo ago
        You're right that you can end up with a suspect list instead of a direct answer, but it shouldn't be hard to narrow it down from there, especially in a case like this where most people wouldn't have access to privileged info about unaired shows to start with. It also helps if you have more than one IP address to start with. You can end up with multiple suspect lists, but only one or two people who show up on all of them.
numpad0 6mo ago
Isn't that how it always worked? You guys never heard of these things before? You sue the social media to get the IP at time, then sue ISP with the reference to that suit to get IRL identity from IP + time, then sue the person using that IRL identity. Some parts of this has been simplified because courts having to process 3 lawsuits to move just couple grands for just a "@username I murder you this particular way and time" is ridiculous. What if the accused used Tor or foreign VPN? I guess the matter goes to local FBI equivalent?
- autoexec 6mo ago
  If it's the IP of a VPN the next step is to send legal requests to Microsoft, Apple, Facebook, Cloudflare, Steam, Google, popular MMOs, and video/music streaming services for all the information associated with that IP address around the same time. Unless someone spent a lot of effort to avoid it, any person with a IP address probably had something that established a connection at some point to one of those companies and that connection probably contained an identifier of some kind. It might have been a software update check, some user telemetry, a browser tab open to social media, a connection to icloud etc. Once you get a match you ask that company for a list of every IP address that was ever used by that user/account, and in that list you should get a bunch of connections from an IP that belongs to a regular ISP. Very few people are using a VPN 100% of the time.
Mindwipe 6mo ago
Twitter only supported 2FA using a mobile number for several years, so they quite possibly have that. People are not always good at infosec for convenience, and Twitter's design for this was incompetent even before Musk's acquisition.

by dfxm12 6mo ago

landl0rd 6mo ago

Twitter has IP addresses at the very least. HBO will then subpoena the account's ISP. If the account had the checkmark pro plan or whatever it's called, it may have or be able to obtain legal name and address for payment details, or its payment processor (Stripe I think) would.

ronsor 6mo ago
And all of this falls apart if you use Mullvad, who will be happy to fax HBO lawyers a blank sheet of paper.
- landl0rd 6mo ago
  At which point twitter will probably yell at you to "verify" with a phone number or something else tied to your government name. Yes you could probably go get a prepaid SIM for cash (depending on your country, many now ban this though America doesn't) but very few people bother with it. Or they just lock your account and demand your ID which I think they now sometimes do.
  - ronsor 6mo ago
    You can pay $5 for a verification phone number. It's not hard.
    - madars 6mo ago
      There are so many more ways one could screw up, and you only need to screw up once. For example, does X do browser fingerprinting and did you ever use similar setup to use a more identifiable Twitter account? Are you using unique phrasings or behavioral patterns? These things can be solved to a satisfactory degree, but I don't think "it's not hard" captures it - for an average user it _is_ hard.
      - fc417fc802 6mo ago
        > Are you using unique phrasings or behavioral patterns? Why would Twitter voluntarily run that sort of query to satisfy a subpoena? Whether it's difficult and risky for the average user depends on the threat model. "Twitter doesn't directly have my name, address, or phone number sitting in their database next to my account" is easy. Other things are more difficult.
        madars 6mo ago
        Phrasing idiosyncrasies are publicly observable and anyone can note - as external observers did in Kaczynski or Hanssen cases - that a particular phrasing is quaint. It is probably true that Twitter is unlikely to run a browser fingerprinting query to de-anonymize someone tweeting spoilers from a softcore porn show. But a potential leaker has to ask: "how sure am I of that?"
- petcat 6mo ago
  > all of this falls apart if you use Mullvad The only thing that falls apart is the IP address identification, which is only a very small signal for identifying an internet user. X/Twitter undoubtedly has more identity information than just an IP address.
- autoexec 6mo ago
  Doesn't matter if the device you used phoned home with your IP address and any kind of identifier. Your OS that sends telemetry every 7 seconds, a windows update check, another tab with a social media account open. It's easy to cross reference that stuff and figure out what a person's regular ISP is. Almost nobody uses a VPN 100% of the time and at the router (because your OS will phone home before you desktop finishes loading).
  - fc417fc802 6mo ago
    Twitter won't have your various device IDs and VPN IPs are typically shared among many clients simultaneously. You could certainly generate a suspect list but I don't think you'll get conclusive evidence. That said I don't know how much browser fingerprinting Twitter might be doing and if fingerprints from other services might be possible to crossreference. Much higher risk is probably visiting other sites both with and without the VPN using the same browser without thinking about it and thus leaking your fingerprint or even account cookies that way. Or if you don't run a filter then visiting a site without the VPN that embeds Twitter tracking assets would leak to them directly.
    - autoexec 6mo ago
      You're right that you can end up with a suspect list instead of a direct answer, but it shouldn't be hard to narrow it down from there, especially in a case like this where most people wouldn't have access to privileged info about unaired shows to start with. It also helps if you have more than one IP address to start with. You can end up with multiple suspect lists, but only one or two people who show up on all of them.

numpad0 6mo ago

Isn't that how it always worked? You guys never heard of these things before? You sue the social media to get the IP at time, then sue ISP with the reference to that suit to get IRL identity from IP + time, then sue the person using that IRL identity. Some parts of this has been simplified because courts having to process 3 lawsuits to move just couple grands for just a "@username I murder you this particular way and time" is ridiculous. What if the accused used Tor or foreign VPN? I guess the matter goes to local FBI equivalent?

autoexec 6mo ago
If it's the IP of a VPN the next step is to send legal requests to Microsoft, Apple, Facebook, Cloudflare, Steam, Google, popular MMOs, and video/music streaming services for all the information associated with that IP address around the same time. Unless someone spent a lot of effort to avoid it, any person with a IP address probably had something that established a connection at some point to one of those companies and that connection probably contained an identifier of some kind. It might have been a software update check, some user telemetry, a browser tab open to social media, a connection to icloud etc. Once you get a match you ask that company for a list of every IP address that was ever used by that user/account, and in that list you should get a bunch of connections from an IP that belongs to a regular ISP. Very few people are using a VPN 100% of the time.

Mindwipe 6mo ago

Twitter only supported 2FA using a mobile number for several years, so they quite possibly have that. People are not always good at infosec for convenience, and Twitter's design for this was incompetent even before Musk's acquisition.