Twitter stores original account names, dox vulnerability via Twitter Spaces

https://twitter.com/tszzl/status/1488466979799265281

by steelstraw • 4 years ago

129 31 4 years ago

smashah4• 4 years ago

There's a mass systematic bulldozing/demolition of whole lower/working class neighborhoods happening in Jeddah, Saudi Arabia right now. Locals use Twitter spaces extensively to discuss, organize and share stories. Twitter spaces needs to have a way to join in in discussions anonymously to say the least. Please give users options around their own risk profile - including voice modulation.

AustinDev• 4 years ago

But what about the trolls?

tata71• 4 years ago

People will leave their Spaces...like always.

BiteCode_dev3• 4 years ago

Using twitter, a proprietary, non e2e encrypted, for profit platform with an history of political meddling and censorship to organize social change seems a dangerous bet to me.

This is basically hoping that:

- they are willing to play nice with you

- they won't get pressured into not playing nice with you

- nobody will use technical means to extract things from them

Meanwhile, while taking this bet, those people are creating a gigantic data graph of persons, backed by detailed twitter tracking, all enriched by tons of evidences of their action, thinking and desired in the form of messages.

So if the big guys want to hit them after that, they can grab this juicy data set and have a blast.

smashah4• 4 years ago

These are everyday simple people, not HN people. They're not thinking about spinning up a matrix server with tailscale while a bulldozer is ploughing through their home.

If the people go to twitter then twitter needs to consider their circumstances and accommodate.

riffic2• 4 years ago

I love that there's a third-party collecting Twitter bugs (one of the replies in the linked Tweet):

https://github.com/simonsarris/Twitter-Bugs

Twitter sure as hell doesn't pay attention to bug reports filed by their own users. You want to test this assumption? Tell me how you're supposed to open a bug report as a user.

mintplant• 4 years ago

It starts with being some kind of celebrity or monetizable public figure. Twitter has long baked class stratification into the platform. Verified ticks are the most visible user-facing aspect of that, but there are multiple levels of advanced toolsets, features, and access made available to VIP accounts.

patcon• 4 years ago

Seems maybe inspired by this: https://github.com/isaacs/github

Was a great resource (and place to vent with like-minded users) before GitHub finally conceded and created a public issue tracking system of sorts <3

saagarjha• 4 years ago

Not to give Twitter a pass for this kind of thing, but isn’t this basically par for the course for most web services? Where do you file a bug report for Facebook? Or Whole Foods?

Cthulhu_2• 4 years ago

That's because they would get flooded by bug reports, like how right now they get flooded with people flagging accounts and tweets (brigades) and I'm sure there's more engineering effort going into automating that system than, say, Spaces or Twitter's primary experience.

jakub_g• 4 years ago

I recently came across this while searching for some old discussions / retweets and found a tweet by someone who I know changed their handle; after clicking RT/QT/reply (don't remember) somewhere in the thread, I saw a form to reply to both their old and new handle.

kevingadd• 4 years ago

This is likely because some replies include the username as text inside of the tweet, you run across it with tweets that are old enough if any of the conversation participants did a nick change. This also means that if an account is deleted or renamed and then later someone claims the old name, it will look like the tweet was replying to them when it was really in reply to someone else.

I think for modern tweets the reply-to is stored in a different way so that it doesn't count against the length limit and is only shown in the replying-to bits of the UI, but I'm not sure precisely how it works.

noelrock• 4 years ago

Not at all the same issue but vaguely relevant — I like the idea of ambiently joining some Twitter spaces without feeling obliged to contribute.

Would strike me as a decent trade off that non contributors should be able to join anonymously.

Whenever I’ve joined something in my specific area to date, I’m called on to contribute maybe half the time by the host - which is generally fine and I’m happy to, but sometimes you’re not able to… so it puts you off joining altogether.

steelstraw• 4 years ago

That might be making it harder for smaller rooms to grow, if there's a lot of users less likely to join because of that. Whereas in big rooms you disappear in the crowd.

WA• 4 years ago

This might be an annoying bug, but I wouldn't call this a doxxing vulnerability. Your userid stays the same, no matter what your handle is. Of course, the userid is mostly hidden for the end user, but there are a few services that track changing handles by referencing the userid. So you could be doxxed all the time anyways. Now it is just a bit more obvious.

Cthulhu_2• 4 years ago

The internet is permanent, and if Twitter themselves don't remember a display name you used to use, 3rd party services will.

If you need to erase your old identity, it's best to create a new account and use your right to be forgotten to have Twitter delete your old stuff. And while the GDPR and the like mandate how that SHOULD work, you can't trust that it WILL work.

iszomer• 4 years ago

Twitter seems to obfuscates recycled username creation dates too. I deleted an OG account from 2008 last year and now I see someone has claimed it but it's join date is from 2018.

shrikant• 4 years ago

If you create a Twitter List and add users into it, they stay in the list even if/when they change their handles.

I used this approach to keep track of scammers a while back when Twitter DM scams were a thing amongst the circles I was following.

m4tthumphrey• 4 years ago

Off topic: Since when did Twitter force logging in to view the site?

MildlySerious• 4 years ago

This has been a slow process for about two years now I think, and has recently gotten a lot worse.

In the past, Twitter would sometimes show errors instead of tweets when not logged in. My assumption at the time was that they were prioritizing logged in users during high traffic hours, but who knows. Then they required you to log in when trying to view the media tab on profiles, and from there it sort of snowballed into its current state, where you can scroll down a couple tweets and then get the full Pinterest experience.

riffic2• 4 years ago

Around August, at least that's when the complaints seemed to start flooding in:

https://www.google.com/search?q=twitter+login+wall+site:news...

Twitter stores original account names, dox vulnerability via Twitter Spaces

Related Stories