Also, is saying things like "Go die" an insta-ban on twitter? I don't use it but I thought it took more than that.
For starters: it would be interesting to see what IP address the tweet was made from, whether or not it was preceded by a password change or contact with Twitter support to turn the account over to someone else.
> When something is egregious what should Twitter do if it doesn't have resources to investigate whether the tweet was "intentional" or not, if action must happen quickly to avoid problems?
Good question. That makes me wonder if they are able to operate safely at scale at all.
> And isn't a claim of "wasn't me" an easy claim whether or not it's true?
Yes. And yet: it wasn't me.
> He says "What really pisses me off is that this is fairly obviously not my fault " But I can't find out where it is so obvious. Obvious to whom?
To me, and presumably, to those who know me and presumably to Twitter employees who have access to a whole lot more data than I do.
I mean if we're going to use fairly simple approaches (keywords on ban lists or user-based flagging / reporting), then shouldn't step one simply be not allowing the post at all, instead of a retroactive instaban on the account after the post has been shared? To me, the simple way is delete the post, or put in a hold queue (warning the user), or at very least not actually share the post on a timeline. Warn the user, don't share the post, and/or delete the post. Then you can still have the desired effect of keeping the platform "safe". Am I missing something? I'm confused all around about social media practices, honestly.
Agree on the "simple way" of warning the user and putting the post on a queue though.
I think that's true on a first offense. But if the user has demonstrated they have no intent to behave or their offense is egregious or demonstrates they know what they're doing, then I don't think there's any problem with a shadowban.
> For starters: it would be interesting to see what IP address the tweet was made from, whether or not it was preceded by a password change or contact with Twitter support to turn the account over to someone else.
>> When something is egregious what should Twitter do if it doesn't have resources to investigate whether the tweet was "intentional" or not, if action must happen quickly to avoid problems?
> Good question. That makes me wonder if they are able to operate safely at scale at all.
i'll hazard a guess that this isn't a factor at all, since the vast majority of cases where such differences exist could be explained by the user traveling and logging in from a different location. your abuse team would declare open riot if they needed to investigate whether every "posted abusive tweet, but from a coffee shop wifi instead of their home" needed to be evaluated as a possible hijack.
like most large services, Twitter has self-service hijack protections: you should receive email notifications when Twitter sees a login from an unknown location (i sure do) with the usual CTA about changing your password and such if you do not recognize it. that does appear to be what you should do here, insofar as they state you can cancel the appeal, delete the tweet, and regain access. asking users to delete tweets made by a compromised account sounds normal enough, given that it's both what will happen anyway
i'll grant that Twitter's account blocks and support system can be _bad_, in that they often have conflicting or outdated instructions, but that's only a problem when the recovery process fails, not when you don't attempt it. this seems more a complaint that they don't offer concierge service but, eh, not much surprise there.
I do not know. The tweet certainly looks like it was made by my account, but definitely not from this computer and definitely not using my password. I'm pretty precise about stuff like that and Twitter would be the least of my problems if my passwords were hacked. For now I am assuming either someone social engineered Twitter to change my password or a compromise of Twitter of some sort.
> but he doesn't seem very fussed about how it happened or keeping it from happening again
Lack of information... of course I'm 'fussed' but I just don't know. All I know is that as far as I can see my setup here is still secure and was not a factor in this.
> just annoyed that Twitter's response to it isn't faster.
No, mostly annoyed that Twitter would not detect a fairly obvious Joe-Job.
> Is it this commonplace for twitter accounts to be taken over?
Good question, I don't know.
> Also, is saying things like "Go die" an insta-ban on twitter?
Apparently, but even then: I didn't say that...
I'm assuming you are using unique passwords per application.
Yes, absolutely, and I only use the web, no other kind of client, no apps etc.
Ever used a friends computer to sign in?
Don't use other computers besides this one for Twitter. The password is very long, generated, so impossible to guess and I have never moved it to another machine.
Obviously other vectors are possible, but in the absence of knowledge it is likely appropriate to react in a secure by default way.
Out of curiosity which OS and browser?
No Javascript unless expressly authorized making some kind of drive-by browser attack quite unlikely.
https://developer.twitter.com/en/docs/twitter-for-websites/t...
Web Intent is a very open API and doesn't require a specific API relationship (you don't need to approve an "app" to do it). It is built to present a confirmation page specific to the given "Web Intent" interaction, but there have been reports over the years of adware/malware bypassing the confirmation page (or phishing the confirmation page) as a spam vector.
Web Intent is on the list of paranoia reasons to not browse the web with an active Twitter session.
Thank you. Between the various comments in this thread bit by bit I'm beginning to wonder how safe this setup really is. Qubes OS starts to look better by the minute...
Authentication app Use a mobile authentication app to get a verification code to enter every time you log in to Twitter.
https://help.twitter.com/managing-your-account/two-factor-au...
Update: they added Authenticator 2FA in 2017 and a security key in 2021.
How could you not notice your password being changed? I would think twitter would invalidate existing logins after a password change forcing you to log back in using the "new" password an your devices. Then again, I never used twitter.
Whether or not I can still log in I do not know because, as I wrote, I'm blocked from using Twitter, the only thing I keep getting now is a page where they want my phone number.
They asked me for it a long time ago, I never gave it to them luckily as they proceeded to leak that information to everyone. I've wrote off the platform ever since.
I noticed that a horrifying number of services don't inform the old email address that an account's email was changed. I trust very few services to keep me fully informed about my accounts these days.
Try to log in with a clear cache or in a private window. If you get redirected back to the page saying to delete the tweet, then you know your password wasn't changed.
Edit: Yes, that worked, so clearly the password is unchanged. Thank you, that at least is a concrete step forward. But that in a way only deepens the mystery.
Do you suspect inner job or flagging bot farm?
One to indicate that my account was locked (2 minutes after that particular tweet was made), one that my appeal has been logged and one that I tried to log in from a machine that had not been seen by Twitter before (true, a VM temporarily booted to check whether or not the password had been changed).
Already answered upthread, someone figured out a way to test this without logging out and the answer is no, it has not been changed.
So it has to be a technical trick of sorts. But what?
As far as I can check it, yes.
> Your account looks completely normal to me.
Ok. It certainly doesn't look normal to me.
> I don't know what a blocked account should look like but to me it doesn't look like your account is banned or anything.
Ok.
> And the tweet in question (which your bafflingly refuse to delete) isn't present.
That's even stranger. But: I also can't delete it anymore so maybe Twitter deleted it? But my account is still in limbo.