The trouble I had trying to contact Twitter support about a security issue

https://twitter.com/i/moments/878356515622617088

by r3bl • 9 years ago

139 43 9 years ago

Disgusting

r3bl5• 9 years ago

On the bright side, at least it didn't take me 82 days to reach someone within Twitter, as much as it took me to reach someone within GitHub two years ago: https://blog.r3bl.me/en/worst-support-experience-ever/

snakeanus2• 9 years ago

I remember reporting someone for doxxing in github comments and I received a reply that they will investigate it 2 months after.

kuschku4• 9 years ago

That’s where you send a C&D to their HQ, or post on social media.

The only two ways to reach such hostile corporations is via legal or a PR disaster.

bfred_it• 9 years ago

Really? I contacted GH support twice and they answered surprisingly quickly and humanly. I wondered how they could do that, given they're so big and with surely so many bogus emails coming in.

r3bl5• 9 years ago

Yeah, my first contact with their support was excellent. My issue got explained within half an hour and it got resolved within an hour (IIRC).

The second was literally caused by a typo on my end, and it literally took 82 days and me asking some random GitHub employee on his AMA repository what to do when support ignores you to get it resolved.

dom0• 9 years ago

I reported a minor security issue once and it was fixed in a day or so.

Edit: Your first reminder email is already quite harsh ("STILL no response? [...] Come on!")... wouldn't be surprised if that pissed the assigned support worker off.

r3bl5• 9 years ago

To be honest, like I said above that screenshot, that was my second reminder email, I didn't take a screenshot of the first one.

maaaats• 9 years ago

This is unreadable on mobile. I have to click on the image to read it, which takes me to a tweet (after quite some time loading), and then have to click the image again. Then click back twice to get to the next image and do the same.

r3bl5• 9 years ago

If it makes you feel any better, it was a pain in the ass to write it down on mobile too. I had to rearrange tweets every time I've added a new one, and then when I published it, they were suddenly all in a different order than the one I've set up. So I had to edit them from the desktop. And I've failed multiple times to edit the description (both on desktop and mobile), so it remains "I'm this moment" instead of "In this moment" in the description of the moment.

watter3• 9 years ago

They're too busy changing the icons and adding border-radius to everything. Don't you know it took them 6 weeks to change the star button into a heart? They are very proud of it! /s

LeoNatan25• 9 years ago

This is just another indication how much these idiotic companies take security seriously. Once some news outlet picks this up and it gains traction, and it becomes a PR problem for them, will this be solved.

OliverJones• 9 years ago

How many times do we forget and have to be reminded?

If you don't pay for the product you are the product.

I wonder how they respond to 2FA fault complaints from accounts like @realKimJongUn .

snakeanus2• 9 years ago

It's like they are paying them to reply with irrelevant links to their support page. I would really not be surprised if every mail that they send to OP was made by bots.

douche• 9 years ago

I've often wondered that about most tech support avenues. At times, I wouldn't have been surprised if Microsoft had an entire staff whose only purpose was to tell people in the MSDN forums that they asked their question in the wrong place (whether they did or not).

reitanqild• 9 years ago

Agree. Really seems to be a general thing in some circles.

See stackoverflow etc were for a couple of years at least it seemed that more likely or not any really useful question/answer would be flagged/closed/something. I've seen less of it lately so either I developed a blind spot, google changed ranking, SO decided to stop doing this (I've seen some people trying to advocate common sense in meta.)

One of my favourites: an otherwise relevant question on networking being flagged of because the equipent in question was placed between two corporate networks and the rules specified that it had to be placed in a corporate network. :-/

crispyambulance• 9 years ago

The user:employee ratio at Twitter is something like 100000 users per employee.

What can you realistically expect from "support" when you're not an actual paying customer of Twitter?

janwillemb• 9 years ago

We're talking about a security issue here, not regular support

kelnos3• 9 years ago

It's not really a "security issue" in the way we think of them. This is just an -- optional -- security feature that isn't working, and as it turns out, not working on just one person's account. The OP shows that Twitter Security actually did investigate reasonably promptly, and replied that they couldn't repro the issue.

And I think that's not unreasonable. The security team is mainly about triaging security vulnerabilities. They likely aren't equipped to deal with an issue that appears to be restricted to a single account, that's related to an optional feature.

Now, Twitter's main-line support seems to be worse than useless, but I suppose that's to be expected, sadly.

graphememes• 9 years ago

Just release publicly how it's broken.

nkozyra• 9 years ago

It's a shame but this is typically the way to make the wheel squeak.

"Security issue" should be a red flag for support.

ikawe2• 9 years ago

There are special channels for reporting security issues.

https://about.twitter.com/company/security

forthefuture• 9 years ago

If you read the last image in the article, Twitter's security team already responded (within 2 days) that because this wasn't reproducible, there was nothing they could do to attempt to fix it.

ikawe2• 9 years ago

Ah, thanks. TFA is pretty unreadable on mobile.

ourcat• 9 years ago

The current rise of "bots" that I'm seeing being developed of late seems to forget one really crucial thing about humans, especially in a time of need: We need to talk to another human.

It started with "choose your option", "press x.." call routing. You know, the ones which keep you trapped in a menu while charging premium rates. How many times have we all shouted "give me a human!!" to an automated call system?

This rampant increase in (money/job/man-hour -saving) bots seems to me to be very short-sighted and totally destroying the relationships that companies used to have (or dreamed of having) with their customers/users/(unwitting prisoners).

watter3• 9 years ago

The icing on the cake is that engineers cost more than support reps. Sure the bot can "scale" but in a lot of cases I wonder if they are really saving by having a team of engineers who cost so much more than phone agents.

tlrobinson• 9 years ago

https://gethuman.com/

nolemurs• 9 years ago

The current rise of "bots" that I'm seeing being developed of late seems to forget one really crucial thing about humans, especially in a time of need: We need to talk to another human.

I don't think this is true at all. If the bots were effective problem solvers then there'd be no problem. The issue is not some emotional need for human connection. OP certainly didn't need that - he would have been fine with a bot that correctly identified his email as a security report, forwarded it to the appropriate engineer, and let him know.

The issue is that the bots are completely useless for anything but idiot problems. Frankly, a comparably competent human would be much more frustrating.

calvinbhai• 9 years ago

Could there be an external factor that's messing it up? is this replicable for accounts that are not based in your country?

culturedsystems• 9 years ago

The author seems to be assuming that, if they enable third-party app 2FA, SMS-based 2FA will be disabled; and so, they're assuming because they are still getting SMS verification codes, app-based 2FA hasn't been set up. But the support documents don't actually say that enabling app-based 2FA disables SMS-based; in fact, the docs seem to view app-based 2FA as a supplement to SMS-based 2FA (to be used when you don't have a signal), rather than a replacement. I tried enabling app-based 2FA, and Twitter still sends me SMS codes, but using the code from Google Authenticator, rather than the one from the SMS, also lets me log in.

So, it's not clear to me that app-based 2FA actually is broken. Still, given the security weakness of SMS, not letting people disable it in favour of an alternative form of 2FA does seem like a bad decision.

pogue• 9 years ago

I've actually never gotten a response to @support on Twitter. And I've messaged them dozens of times about different issues. I didn't even realize that account was for getting questions answers, I thought they just posted out status updates or something.

smsm42• 9 years ago

Common problem for all major services: if you have support that actively answers the requests, you'd get flooded with all kinds of junk, and hiring people that can a) sort through the junk without quickly burning out and b) be able to distinguish "i clicked something and now internet is gone!!! help!!!" people from people reporting legit problems - it is very expensive. I'd say prohibitively expensive. And if you don't go to this expense, eventually somebody somewhere gets false negative and shames you on all social media. I haven't found many exceptions from that rule - if you want to report something to a big company, you'll have to deal with several layers of bots or bot-like script readers, which have zero incentive of escalating your issue (they are probably trained to have very high escalation threshold, otherwise everybody would demand to speak to Twitter CEO about some dude posting offensive stuff on Twitter). So either arm yourself with a lot of patience, or give up.

The trouble I had trying to contact Twitter support about a security issue

Related Stories