If twitter ‘verified’ means anything, it means a chain of identity has been established between Twitter and the purported owner of that account. That chain should be documented somewhere - there must be some record in the ‘verified account management’ system that says something to the effect of ‘after we gave this actual verified human this token, this email from this address arrived on this date containing that token, establishing that this person had control over that email address on that date’.
If random twitter admins can change the email address and disable 2fa on verified twitter accounts, and those accounts can still publish tweets without them going into a ‘held pending verification that the blue check mark still applies to the person now in control of that account’ queue, then twitter verification doesn’t mean much.
Which might be of interest to organizations like the SEC who hold that communications over a verified twitter account count as official corporate notices, and various public safety organizations that have let it be known that messages on their twitter can be relied on as a source of official information during natural disasters...
Twitter needs to get serious about blue checks.
Not really, a blue checkmark is just a status symbol.
What I'd like to see is, the Blue Tick being restored to be an actual mark of Verification, and be something that anyone can apply for with the appropriate identification documentation.
Additionally, there should then be a toggle switch, where only Verified accounts see tweets and replies from other Verified accounts[1]. This would effectively create two Twitters; one where every account is identifiable and accountable for what they tweet, and another that continues with the anarchic system they have now, where hate speech, racism and intolerance run rife[2].
---
[1] I've heard rumours that this toggle switch already exists on Verified accounts - can anyone confirm ?
[2] Yes, free speech may be trapped here too, unless some sort of middle ground can be worked out.
Replace the checkmark with a Verified Badge that says their position if they're an elected official or major organization leader, or just Real Name if they've verified their ID.
He wrote this in response to the Jason Kessler kerfuffle, well before the "factcheckUK" stunt, but it would have actually solved that too! Imagine seeing the username "factcheckUK" with the Verified Badge "Conservative and Unionist Party, UK 🇬🇧".
https://medium.com/@yonatanzunger/the-hard-lessons-of-blue-c...
But at the same time, in aggregate, blue check marks do provide some degree of legitimacy to accounts - yes, this account is that person you know from outside twitter.
But twitter don’t do a great job of explaining how they verified an account, or even who they verified it to be. As has recently gone viral, twitter gave @sistersofmercy a blue check mark, because they really are the catholic institute of that name - not the band (@tsomofficial doesn’t have a blue check mark ...)
I think there’s the basis of something interesting in ‘verified accounts’ - and for sure they’re flawed - but I don’t think ‘meaningless’ is correct.
So @sistersofmercy might get a Verified Badge saying "Religious Institute, Ireland", and @tsomofficial might get a Verified Badge saying "Musical Group, UK".
He wrote this in response to the Jason Kessler kerfuffle, well before the "factcheckUK" stunt, but it would have actually solved that too! Imagine seeing the username "factcheckUK" with the Verified Badge "Conservative and Unionist Party, UK 🇬🇧".
https://medium.com/@yonatanzunger/the-hard-lessons-of-blue-c...
Twitter needs to get serious period and not just blue checks.
Also a lot of the other FANG type companies are effectively CNI - I think they need to start properly vetting people and I mean real security clearance possibly including TS
That sounds to me like it's simply having a 2nd person verify the email change is correct. So your suggestion and the article's suggestion ("should at least need two people to change key settings") seem to be very similar if not the same as each other.
For personal celebrity accounts maybe verification is just that the email address must send in a scan of a government photo Id, and sure maybe that triggers a manual check, but it’s not just a ‘two keys’ solution - it’s a verification process.
Sure, the same admin console might be able to go in and change the verification mode and rules on a verified account - but that’s something that would happen rarely, and a flurry of activity changing the verification process for a bunch of accounts would definitely merit a red flag.
Why would you want to ever allow an admin to transfer control of a verified account to an unverified person?
If you're saying that the account recovery process needs to be at least as secure as the credential that was verified (e.g. email address), then I agree. But I don't think reversion to a "pending" state would ever be desirable, though.
https://github.com/shabda/tweet-signer
At it's core it's just a spec, so feel free to write your own tools! Suggestions for improving the spec welcome. Please use Github issues
Restoring it took 24 hours, during which I got bombarded with text messages and emails warning me that someone was restoring my backup, and that if it wasn't me, I should immediately click or reply to prevent it from happening.
Seems like that might help - a 24 hour waiting period on any significant account changes for verified accounts.
https://www.wired.com/story/sim-swap-fix-carriers-banks/
"The SIM Swap Fix That the US Isn't Using While foreign phone carriers are sharing data to stop SIM swap fraud, US carriers are dragging feet."
I've looked but as far as I can tell, such an API does not exist, alas.
(It's true there are a bunch of important things that PGP has helped solve. Ubiquitous person-to-person secure communication and person-to-service cryptographic authentication are not amongst them. PGP is certainly usefully employed in some niche use cases, but it has failed at pretty much all it's original goals. I can't remember that last time I used it for anything except verifying a software download, and even _that_ use case only applies to a tiny fraction of places that hoist software downloads. My Arch linux installs running pacman and silently checking php signatures for me may be the only time I've had PGP code run in maybe a decade...)
There are a handful of bytes reserved for a future purpose, which could be used for something like this, but you're limiting how large the message can be, likely significantly.
Should we be OK with what has become a significant communication platform being run with sub-par security because it's "expensive" to do it properly?
I find it quite horrifying that elected officials are legally allowed to use totally unaccountable social media platforms to communicate policy to the public.
It also creates a number of issues. If twitter decides to ban me, doesn't that impact my right to contact my representatives via twitter (especially since a judge has already ruled that a government official blocking a person on twitter does violate their right). Seems that the government should only be allowed to use a platform for communication if that platform is treated as a public square that all can access regardless of past history, same as public squares of the past. This isn't putting a limit on Twitter, they are a private company and can do what they want. This is putting a limit on the government. Now, if Twitter helps the government establish such an account, then they would be a private company choosing to open itself up as a public square and, specifically with regards to the parts that are a public square, losing some of the rights of a private company (they can't ban you from the public square, but they can ban you from anywhere else as the rest of the site isn't part of the public square).
The ultimate check on the behavior of elected officials is supposed to be the voters. You shouldn't have to have laws to prevent them from making bad choices. In this case, the voters like their speech to be "tell it like it is", which mostly means hating the same people they hate. They're getting what they asked for, and are likely to ask for it again.
Next thing, some will demand that all communications with the government happen over twitter too (or another private entity), thus forcing people to have accounts on them.
I’ve worked with several of these types of organisations and the ones that actually want to manage that access well, typically do a pretty good job (though some of them actually want to do it badly, or just don’t care).
Locking down access to sensitive admin consoles isn’t tremendously difficult, requiring additional approval workflows for highly sensitive operations isn’t particularly difficult, and in that context non-repudiation is rather simply to address.
How about... anybody who has customers in the EU?
The only thing the GDPR says that would apply in this circumstance is this:
> processed in a manner that ensures appropriate security of the personal data
As I stated above, the EU provides exactly 0 guidance on what “appropriate security” is, and no form of standard at all that it expects you to comply with. To make matters more confusing, an organisation is allowed to take their own budget into account, against the cost of security controls, when deciding what is “appropriate”.
You could ask the question, was twitter appropriately secure? You might come to the conclusion that they weren’t, because they were breached and any system that is breached must not be appropriately secure. That wouldn’t be an unreasonable conclusion, and as far as anybody knows that could very well be the standard that any data protection authority may decide to uphold at any time of their choosing. But then that would lead you to consider that there is no such thing as a system that can not be breached, so in that case there would be no such thing as a GDPR compliant service.
Combined with, as you say, that GDPR also states as a matter of principle data must be “processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing” - I would take that as meaning you can’t just leave data openly accessible to people who don’t need to process it and rely on them not accessing data they don’t need, you are expected to protect the data against that risk. I.e. secure access to data so it can only be processed for necessary purposes.
It is possible for small organizations that ‘telling Janet she isn’t allowed to look in the customer accounts spreadsheet’ is an adequate control but as organizations get bigger obviously the expectation that technical controls should be in place expands.
> processing is necessary for compliance with a legal obligation to which the controller is subject
I know that people with access to some telecom systems in the UK have to have been vetted some even to DV level - ie the same as if you where working for a TLA.
So having to pass a TS clearance and the whole SF86 form for FANG employees is a possibility "so Elon about your pot smoking habits"
An hour after @elonmusk's first scam tweet, 7 celebrity or corporate accounts had tweeted the scam, all with the same Bitcoin address. With the two-click system I described, how many compromised admin accounts would you expect the security team to have been able to suspend by then?
8 more celebrity accounts went on to tweet the scam, plus @elonmusk and @kanyewest repeating the scam tweets.
https://www.theblockcrypto.com/post/71906/twitter-account-ha...
Sure, it's a sucky position to be in, but I can see why they might have been hesitant to dive right in and start trying to undo damage before understanding what had happened.
I mean, after all - it was only the cattle.
It's not as if the attackers got into the accounts of customers, the paying advertisers.
(Besides, the Part Time CEO was probably in Africa and unavailable to provide decisive direction, right?)
World leaders are also politicians that need to maintain their internal position (even dictators need to at least prevent a coup). So when they spew inflammatory rubbish it's often to appear tough to their internal audience, often at the cost of the interest of their own country.
This ideal world has to figure out how to deal with this conflict of interest.
Furthermore, the next attack will probably be automated and be against far, far more accounts.
Response time during lunch hour might be slower initially, but after responding to the first compromised account I don't think they'd be any slower.
If an admin account is only supposed to be for use by a human employee, it should have a rate-limit tripwire that automatically suspends the account and alerts the security team.
A Hollywood celebrity? A bay area techbro "celebrity"? Or a Bollywood celebrity? Or a British Royal family celebrity? Or a KPop celebrity? Or a Russian oligarch celebrity?
The middle of who's night??? Twitter does exist on the other side of the Bay Bridge you know...
Define 'middle of the night'. Is that Eastern US, Western US, GMT, or CET?
If I assume it's 2 AM pacific (since Twitter HQ is in SF), that's 11 AM in most of Europe, which makes it middle of the day for about 700 million Europeans, many of whom speak English and are interested in US celebrities. And that's still ignoring the majority of the World.
Anything on the internet is 24/7. Musk regularly tweets in the 'middle of the night' and I see those tweets come in while drinking a cup of coffee.
Also, Twitter has offices around the world and people don't collectively log out for lunch at a specific time, so there should always be people available to handle this type of incident. Provided they get the training and tools to do so.
But people who do think it's possible probably think it would happen something like this: https://twitter.com/realdonaldtrump/status/12139194805748121...
For accounts that could start a war this might be necessary, but for celebrities with >10K followers this sounds expensive and unnecessary to me.
To me, it seems like you could instead ensure the admin view of every account has a timestamped log of recent settings changes, including changes done by admins, with a link to the profile of the admin responsible, and a button to suspend that admin account with one click.
This way, the security team could've seen that Elon Musk's account had just been reset by J. Random Employee minutes before tweeting the suspicious bitcoin tweet, messaged J. on Slack to be like "hey did you do that?", and suspended the compromised admin account within minutes.
Sure, some accounts might be briefly compromised initially, but it would be resolved in minutes and not the hours that it took Twitter, right? That seems fine for what should be a relatively low-likelihood, high-expense attack like compromised admin account (of course, you have to ensure that is the case).