News for hackers. Stuff that matters.
Re:Twitter set to accept Musk's $43B offer – sources by malfist on Monday April 25, 2022 @09:38AM (#31154466)
How does charging for a checkmark prevent bots? Forgive me if I'm wrong, I'm not a twitter user, but typically, aren't bots not verified?
Re:Twitter set to accept Musk's $43B offer – sources by dd36 on Monday April 25, 2022 @09:47AM (#31154618)
The idea is that you can filter out the unpaid.
Re:Twitter set to accept Musk's $43B offer – sources by XorNot on Monday April 25, 2022 @10:21AM (#31155196)
How many accounts are needed to meaningfully influence a Twitter story? How much can you charge for a checkmark that people will pay for?

Because if a checkmark costs $1/month for example, then spending a couple grand to be able to turn any story you want into "trending" is chump change for corporations, governments, and any particularly motivated silicon-valley salary'd employee.

There are already services which essentially sell you retweets - all this is is an adjustment to their business model to sell "verified retweets" and "aged verified retweets" (in case you want accounts with a posting history to do it).

It's a cost model adjustment, that might not even cost that much - after all if "verified" accounts receive less scrutiny from anti-bot algorithms, then they'd be cheaper to run then the developers/workers who need to keep your sockpuppet farm ahead of the game.

Re:Twitter set to accept Musk's $43B offer – sources by mrtranscendence on Monday April 25, 2022 @10:59AM (#31155792)
What if it cost $2 a month plus a scanned copy of a government-issued ID?
Re:Twitter set to accept Musk's $43B offer – sources by nindalf on Monday April 25, 2022 @11:51AM (#31156601)
It’s possible to generate realistic looking IDs. It’s not that hard, any person reading this comment can do it.

Get a face from a thispersondoesnotexist.com like generator. Get the format of the ID in a template, fill in random but realistic data. Like for example, 1000 names for each race-gender combo. Realistic zip codes and addresses from another source.

It’s about a weeks work to get it working to production quality, but it can be easily done.

For bonus credit, see if you can generate an image of the same person holding up this ID. Harder, but not impossible.

What’s frustrating is, those of us who work or have worked in Integrity have already discussed all of this for years. We know the easy solutions, the low hanging fruit. It’s not that helpful when a bunch of people say “why don’t you just charge $2 a month”

Re:Twitter set to accept Musk's $43B offer – sources by sangnoir on Monday April 25, 2022 @11:25AM (#31156199)
Governments can generate IDs for thier sock-puppets for online influence campaigns.

Non-government actors can get in on the action by procuring IDs in other ways ("Make money by scanning your late maw-maws ID"[1]), or large scale phishing campaigns (fake jobs or college admissions abroad with 100% applicant success rate, the only catch is scanned IDs and qualifications are required).

Electronic forgeries are likely the best way to do it at scale; just the other day, therr was a top story ok faking as if your document was scanned. Do the fine people handling verifications at Twitter know what a legit Madagascan ID looks like?

1. Or "Get $10,000 funeral assistance from this new Biden admin relief program"

Re:Twitter set to accept Musk's $43B offer – sources by Jensson on Monday April 25, 2022 @11:35AM (#31156346)
Now you are committing extremely serious crimes instead of just spamming though, few would risk that. So this might not solve all spam, but it would probably solve 99.9% of it.

> Do the people at Twitter know what a legit Madagascan ID looks like?

Yes, there are guides for checking ID cards, how do you think that they check ID cards in real life?

Re:Twitter set to accept Musk's $43B offer – sources by sangnoir on Monday April 25, 2022 @11:56AM (#31156674)
> Now you are committing extremely serious crimes instead of just spamming though, few would risk that.

Oh no, I've broken the ID forgery laws of Burkina Faso and am in big trouble now. Isn't it a rule of low-level scamming to always target jurisdictions away from your own? State-actors don't care about commiting crimes against themselves, only the mid-level, "semi-pro" threat actors care about avoiding major crimes.

Re:Twitter set to accept Musk's $43B offer – sources by wutbrodo on Monday April 25, 2022 @11:57AM (#31156690)
I still don't underatand why paying would help. Wouldn't simply filtering out the unverified work the same way?
Re:Twitter set to accept Musk's $43B offer – sources by dd36 on Monday April 25, 2022 @01:00PM (#31157660)
Paying verifies.
Re:Twitter set to accept Musk's $43B offer – sources by wutbrodo on Monday April 25, 2022 @04:27PM (#31160149)
Obviously, but verification already exists. For your answer to make sense, one needs to assume that there's a non-trivial problem of verified bot accounts.

Is that assumption correct? It seems incredibly wrong to me, but I may be misinformed.

Re:Twitter set to accept Musk's $43B offer – sources by dd36 on Monday April 25, 2022 @06:25PM (#31161563)
Verification only exists for a small group not the general public.
Re:Twitter set to accept Musk's $43B offer – sources by wutbrodo on Monday April 25, 2022 @08:01PM (#31162440)
Ah OK, so you're saying that this will enable an expansion of verification, which will then serve as a solution to the bot issue.
Re:Twitter set to accept Musk's $43B offer – sources by lrae on Monday April 25, 2022 @09:48AM (#31154635)
They aren't. There are sometimes hacked verified accounts being abused, and I guess charging for the checkmark would result in less verified accounts and thus less hacked accounts... but bit of a reach :)

Those are also not really the problem.

Re:Twitter set to accept Musk's $43B offer – sources by rdtwo on Monday April 25, 2022 @10:26AM (#31155274)
Send them a 2fa key token with their fee and call it a day
Re:Twitter set to accept Musk's $43B offer – sources by DrBoring on Monday April 25, 2022 @11:39AM (#31156404)
Once upon a time, I was on a dev team which had to share an RSA 2FA token for accessing a client's VPN. Rather than pass it around to whoever needed it, we just pointed a webcam at it.