Hacker News Reader

Comment by sakisv | Hacker News Reader

From Twitter's statement:

> People who did not have this setting enabled or do not have a phone number associated with their account were not exposed by this vulnerability.

This is a bit disingenuous, given that you can't really open an account unless you provide a phone number to "verify" it.

Edit for clarification:

As gojomo said below (https://news.ycombinator.com/item?id=22233612) you may not need to provide it during sign-up, but your new account is almost immediately locked for "suspicious activity" and you need to provide a phone to unlock.

View on HN

The whole phone number thingy for added security 2 factor auth has been quite the scam.

Why wouldn't you though, that's gotta be pretty juicy data. You can compare phone numbers across so many different databases now, makes profile creation 10x more efficient. Not really surprising that everyone wants your phone number badly these days.

Microsoft does the same thing btw. Was really fun for a friend of mine who registered a Microsoft account for mixer, forgot about, bought Halo, needed an MS account to log in, thought hey I already have one, and instantly got locked out because it didn't have a phone number.

I bought a dress, a cookie, and a book yesterday from a mall in India.

All 3 asked me for my phone number. It’s getting ridiculous

Do you put your real number in for those kinds of purchase? I generally just put in a random 800- number.

I just say "No, thanks" with a smile.

Doesn't India link phone numbers to bank accounts?

As I've understood it, it's more like you can charge (some things) to your phone bill. Like buying ringtones/apps for 00's phones, but not just phone-related purchases.

lonelappde is right. All bank accounts in India must(?) have a registered phone number associated with them. This was primarily done to ensure SMS transactional alerts, but has escalated to all sorts of usecases now (including the enforced regulated way of doing 2FA).

I went to the apple store to buy a router. It took me involving the manager before the guy let me pay without leaving my name and address.

India is just ridiculous in this regard. Recently, there's some app at security gates at the entrance of apartments that asks for phone numbers. It's strange that one needs a phone number to visit my friend.

Context for others, the app is likely https://mygate.com/

Having something as personal as a phone number should be seen as a liability, not an asset.

It's for anti-spam. Preventing people from generating millions of free accounts is valuable.

It's batshit crazy. But the PR campaigns/marketing by the companies that want your phone number for other reasons seems to have worked.

That might be the case now, but twitter didn't always require them.

I wouldn't be surprised if there are 10s of millions of accounts without phone numbers associated with them.

They "requested" my phone number after the fact. And by "requested" I mean I wasn't exactly given a choice. I wasn't able to access my account until I provided a number. Of course all this was for "security" reasons. Personally I'd prefer to use Google authenticator anyway.

I feel as if one of the many elephants being overlooked here is how 'security' is being abused to further data collection. When an account gets locked now, I don't think it is for actual security, but to increase data collection. Tragedy of the commons being exploited by major websites. The same ones which also want to hold themselves as the arbiter of truth (or at least as one of the Arbiter's official spokesmen).

Does this vulnerability affect people who added a phone number but then removed them? Last time I tried, this method was effective for getting around the "suspicious activity" lock.

Even if you disconnect the number, they still keep it on file.

I have a small network of legitimate accounts that they've suspended a few times. In this last round of suspensions, I can't reset any of them with my phone numbers any more.

No, it wouldn't work. It only works if people can discover you with the "find people you know from your address book" feature. A deleted number won't match. Or you can just turn it off in your discoverability settings.

Instead of providing a phone number you can also email support and complain about the account lock. But yeah, it's a pretty scummy bait and switch behavior.

I personally tried this. Pregnant silence.

I had to send at least six emails to get this to work. Six.

My account was locked, I never sent a single tweet or even followed anyone, just refused to provide them more information about myself.

Same, looks like twitter just locks any account that isn't active enough for some reason.

So people don't generate thousands of accounts then sit on them until they want to spam with legit-looking seven year old accounts.

Indeed: using email based sign up usually immediately triggers a suspension. It can take as little as a few minutes.

I just checked the twitter signup form, which does have a phone input. But there's a toggle saying "use email instead".

So, no phone number is required.

New accounts without an associated phone number tend to face a lock & challenge, for "suspicious activity" (even if they've never posted), which can only be reversed by adding a phone number.

So, Twitter is de facto requiring phone numbers on many more accounts than the initial sign-up flow might indicate – to the detriment of user privacy, & increasing the damage of compromises like this one.

Note that activities which are potentially suspicious aren't just about posting, it includes following people, because that makes their follower count go up, and the whole point of displaying that count is most people want to appear popular - and so of course people create bogus followers.

I agree that Twitter using this to get people to give them PII those don't want Twitter to have, especially when Twitter aren't a good custodian of that PII is terrible, but it's not as though Twitter's other option (anybody can mint a thousand bogus Twitter followers with no pushback from Twitter) looks great either.

Yes, Twitter now considers everything "suspicious", including the minimal steps required to use Twitter as a logged-in account at all, like "following people" (even just a few).

And thus, Twitter more-or-less requires phone numbers from everyone. This increases the risk that Twitter's users will be "doxxed" – and even, when those users anger certain large violent organizations, the risk they'll be assassinated.

I never used twitter until last year when I made an account. They flagged me for following 5 people and liking some posts, locked me out, and notified me that any attempts to send support a request would be ignored. I can’t even log in or contact anyone to delete the account.

I guess the future is to be given the middle finger so eagerly by bad ai all the time

If using the application for its intended purpose makes your account seem not-human, just who or what did they design the application for?

For entities whose behavior fit their model, it's called negative selection[1], a mandatory attribute of emerging dictatorship.

[1] https://en.wikipedia.org/wiki/Negative_selection_(politics)

My account (created without entering a phone number) was locked immediately after logging in the first time, from the same IP I signed up with, without performing any actions. This was over 12 months ago.

> I agree that Twitter using this to get people to give them PII those don't want Twitter to have, especially when Twitter aren't a good custodian of that PII is terrible, but it's not as though Twitter's other option (anybody can mint a thousand bogus Twitter followers with no pushback from Twitter) looks great either.

Third option: don't display follower counts.

Hiding counts makes it hard to identify imposter accounts and bots. Users need to be able to see account age and counts at a minimum.

They let you create an account without a phone number, and immediately afterwards lock the account until you provide one, for alleged "suspicious activity".

Try it.

Can confirm this. Tried to set up a new Twitter account for business use, got the phone number challenge but wasn't able to go any further because the number I wanted to use was "already in use" i.e. my own number I already stupidly associated with my personal twitter account.

To add insult to injury I've been suspended permanently because Twitter's "offence" AI can't distinguish between black humour and a direct physical threat. But that's another story.

The same thing happened to me. But I was somehow able to create a new account on Microsoft Edge. It hasn't been disabled, but I don't plan to use it. If they want to kill their own business, I say let them.

They insta-banned two new accounts from me (for side-projects) after I entered my phone-number which was associated with my personal account. They went from a no-law-free-spam zone to shoot-first-and-don't-ask-later.

Disagree. If you make a Twitter account and then use it without a phone number it will quickly be locked to force you to prove you're human. It took less than 3 hours for mine. They want my phone number to unlock it enough to delete the account. No way.

Reply on news.ycombinator.com