Hacker News new | past | comments | ask | show | jobs | submit login
Twitter stores original account names, dox vulnerability via Twitter Spaces (twitter.com/tszzl)
129 points by steelstraw on Feb 1, 2022 | hide | past | favorite | 31 comments



There's a mass systematic bulldozing/demolition of whole lower/working class neighborhoods happening in Jeddah, Saudi Arabia right now. Locals use Twitter spaces extensively to discuss, organize and share stories. Twitter spaces needs to have a way to join in in discussions anonymously to say the least. Please give users options around their own risk profile - including voice modulation.


Using twitter, a proprietary, non e2e encrypted, for profit platform with an history of political meddling and censorship to organize social change seems a dangerous bet to me.

This is basically hoping that:

- they are willing to play nice with you

- they won't get pressured into not playing nice with you

- nobody will use technical means to extract things from them

Meanwhile, while taking this bet, those people are creating a gigantic data graph of persons, backed by detailed twitter tracking, all enriched by tons of evidences of their action, thinking and desired in the form of messages.

So if the big guys want to hit them after that, they can grab this juicy data set and have a blast.


These are everyday simple people, not HN people. They're not thinking about spinning up a matrix server with tailscale while a bulldozer is ploughing through their home.

If the people go to twitter then twitter needs to consider their circumstances and accommodate.


Twitter doesn't need to do anything.

It's a for profit private company, not an NGO.

It's not a water company, it doesn't have legally a duty to its clients.

It will do what is good for twitter.

I guess the lesson will be learned by paying a heavy price again and again until it sticks.


NGOs also don't need to do anything. Nobody has to do anything. You don't have to reply to my comments. I don't need to reply to yours. I don't need to explain simple corporate responsibility to not enable dictatorships to easily target people to you. I'm not an NGO.

I guess the lesson that I've learnt is that there's always a gormless oddball on HN that attempts to instigate an irrelevant argument. Unfortunately, it's a heavy price I continue to pay. Hasn't stuck yet :(


There is no need for insults.

The argument is only irrelevant if you consider the matter solved. But it's not.

You still think "Twitter should do something", like if 30 years of big IT corporation behavior history hasn't proven it's wishful thinking.

What we need is keeping educating people to not use those platforms for anything that requires privacy, to not give all their data to GAFAM and make safe systems more user friendly and ubiquitous. So that it doesn't stay in the HN bubble.

This is not wishful thinking, as people around me are asking me more and more about privacy. Last month, my little bro told me to switch to encrypted channels to talk to him, for something I though was overkill. He is not in IT. It's a slow process, but so is teaching everyone to read.

In that regards, having such argument is a good thing, since that, even in HN, it's a healthy way to discussing between people tech saavy what we could prioritize as a community.

I assume, that, since we are discussing it, some of us are interested in the problem and our role in it.


The logistics and practicality of teaching whole swathes of a population living under a US-backed dictatorship how to make sure they have secure means of communication arouses more suspicion than just using twitter, where everyone is already. Getting caught with technical and secure means of communication can be used as evidence in witch hunts. Having Twitter installed, on the other hand is not. Let the chickens hide in plain sight, just don't advertise their information to the wolves.

I don't work at Twitter which is why I'm doing what I can by bringing it up here so someone at Twitter can do something about it. One way to make sure this problem doesn't get solved is to say things like "Twitter is a private company they don't owe anyone anything". Maybe if we as a community stood together to demand these features of big companies then they would consider it a must-do. Cynicism, no matter how valid (very, extremely, enormously valid) is not a reason to let these big Co's relax for even one moment in the pursuit to protect its users.


You're right, of course.

But anyone worth their salt (imo) would consider these matters.


Sure, these people understandably turn to an easy and familiar tool in a time of crisis.

But the problem is that Twitter has no incentive to do anything at all other than optimize for ad revenue. Which is not a judgement -- it's just physics.

We cannot expect large, private, for-profit enterprises to act compassionately out of moral obligation. The answer is going to lie elsewhere.


Well ...

a) It's not just Physics as it's not Physics at all.

b) If society is simply behaving in a way that maximizes short-term profits, we're doomed (or doomeder?). The good news is that there is a ton of evidence that this behavior is tempered by at least a little bit of thought for the future.

c) Companies still recognize that "customer goodwill" is a valuable asset even though it's neither quantifiable or convertible.


Relying on a for-profit company for our communications with one another, a company to whom we pay nothing -- this is doomed to failure.

For thousands of years, we've relied on various forms of public and private postal service. The public ones were funded and run by whatever government, and the private ones provided a service for their customers in exchange for payment. Phone companies have mostly been technically private but heavily regulated, and funded directly by their customers.

That all worked well enough. In contrast, what we have here with Twitter is a system where the customers are the advertisers. The communications on the platform are a byproduct. In this scenario how could we expect Twitter to act any differently?

We need something way different and we tech folk can be part of the solution. Distributed open platforms with public funding and which welcome regulation -- this seems like a direction with some hope.

But I will not be betting on a few do-gooders at Twitter having a little bit of thought for the future acting as our savior.


> But I will not be betting on a few do-gooders at Twitter having a little bit of thought for the future acting as our savior

Agreed! And we desperately need a savior.

I just wanted to point out that it isn't as simple as assuming companies are simply aiming to algorithmically maximize profits.


There are a multitude of other options. Hell, WhatsApp with encryption turned on would be better option.


But what about the trolls?


People will leave their Spaces...like always.


This might be an annoying bug, but I wouldn't call this a doxxing vulnerability. Your userid stays the same, no matter what your handle is. Of course, the userid is mostly hidden for the end user, but there are a few services that track changing handles by referencing the userid. So you could be doxxed all the time anyways. Now it is just a bit more obvious.


The internet is permanent, and if Twitter themselves don't remember a display name you used to use, 3rd party services will.

If you need to erase your old identity, it's best to create a new account and use your right to be forgotten to have Twitter delete your old stuff. And while the GDPR and the like mandate how that SHOULD work, you can't trust that it WILL work.


Twitter seems to obfuscates recycled username creation dates too. I deleted an OG account from 2008 last year and now I see someone has claimed it but it's join date is from 2018.


If you create a Twitter List and add users into it, they stay in the list even if/when they change their handles.

I used this approach to keep track of scammers a while back when Twitter DM scams were a thing amongst the circles I was following.


Off topic: Since when did Twitter force logging in to view the site?


This has been a slow process for about two years now I think, and has recently gotten a lot worse.

In the past, Twitter would sometimes show errors instead of tweets when not logged in. My assumption at the time was that they were prioritizing logged in users during high traffic hours, but who knows. Then they required you to log in when trying to view the media tab on profiles, and from there it sort of snowballed into its current state, where you can scroll down a couple tweets and then get the full Pinterest experience.


Around August, at least that's when the complaints seemed to start flooding in:

https://www.google.com/search?q=twitter+login+wall+site:news...


Not at all the same issue but vaguely relevant — I like the idea of ambiently joining some Twitter spaces without feeling obliged to contribute.

Would strike me as a decent trade off that non contributors should be able to join anonymously.

Whenever I’ve joined something in my specific area to date, I’m called on to contribute maybe half the time by the host - which is generally fine and I’m happy to, but sometimes you’re not able to… so it puts you off joining altogether.


That might be making it harder for smaller rooms to grow, if there's a lot of users less likely to join because of that. Whereas in big rooms you disappear in the crowd.


I love that there's a third-party collecting Twitter bugs (one of the replies in the linked Tweet):

https://github.com/simonsarris/Twitter-Bugs

Twitter sure as hell doesn't pay attention to bug reports filed by their own users. You want to test this assumption? Tell me how you're supposed to open a bug report as a user.


It starts with being some kind of celebrity or monetizable public figure. Twitter has long baked class stratification into the platform. Verified ticks are the most visible user-facing aspect of that, but there are multiple levels of advanced toolsets, features, and access made available to VIP accounts.


Not to give Twitter a pass for this kind of thing, but isn’t this basically par for the course for most web services? Where do you file a bug report for Facebook? Or Whole Foods?


Seems maybe inspired by this: https://github.com/isaacs/github

Was a great resource (and place to vent with like-minded users) before GitHub finally conceded and created a public issue tracking system of sorts <3


That's because they would get flooded by bug reports, like how right now they get flooded with people flagging accounts and tweets (brigades) and I'm sure there's more engineering effort going into automating that system than, say, Spaces or Twitter's primary experience.


I recently came across this while searching for some old discussions / retweets and found a tweet by someone who I know changed their handle; after clicking RT/QT/reply (don't remember) somewhere in the thread, I saw a form to reply to both their old and new handle.


This is likely because some replies include the username as text inside of the tweet, you run across it with tweets that are old enough if any of the conversation participants did a nick change. This also means that if an account is deleted or renamed and then later someone claims the old name, it will look like the tweet was replying to them when it was really in reply to someone else.

I think for modern tweets the reply-to is stored in a different way so that it doesn't count against the length limit and is only shown in the replying-to bits of the UI, but I'm not sure precisely how it works.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: