Is this an accurate statement?
If so, why did nearly 1000 employees (12% of the workforce) have access to this mode before it was restricted, and what's the business case for that?
Usually developed for testing purposes (easiest way to reproduce a problem, after all) and prevents password-sharing. But it can obviously be used for evil, and so it should be heavily logged and flagged.
This is a clear breach of infosec if there's a $#%*# su to post as Waldo and Waldo can't see that post.
In fact it seems ONLY possible to do _evil_ with that feature.
For instance, consider the Twitter DMs exchanged by Donald Trump, Jr and WikiLeaks. In that particular case, the communication was acknowledged by the party in question, but imagine the two possibilities thousands of employees being able to act on the part of users opens up:
1. Twitter employees could fabricate a criminal conspiracy by creating messages between multiple Twitter accounts.
2. A criminal conspiracy can now use the "Wasn't me, must have been some random Twitter employees" defense.
It would be quite easy to argue that a highly-politicized org like Twitter _might_ alter tweets or DMs to implicate someone in the opposing party. That’s reasonable doubt that at least some jurors would buy.
But that turns into "there was a sizeable conspiracy to fabricate evidence", as opposed to "a random person out of 2000 got bored, had a grudge, decided to have a laugh, and was acting alone".
I could see this being billed as a feature of a privacy-forward chat platform. Messages are slipped into conversations without either party having actually sent them and no way to tell whether they were real or not.
Eg. simple things like tracking-busters where it randomly clicks links in headless chrome to fool the algorithm, p2p vpns where you use a random user’s IP address to randomize who made what request, etc.
There is also a school of thought that you should periodically publish private keys for plausible deniability (“was it me, or did someone sign that after I published the key”).
Could be thwarted by some kind of "source" database column/field/value that says "this is a tweet made by God mode"
Whether Twitter has that field, if it is internal only, and if they would share it with the public/a court of law, I have no clue
1. No employees have direct, immediate access to user accounts or data.
2. Only a small number of employees should ever be able to gain access to user accounts or data, for the purpose of resolving issues directly affecting said accounts or data.
3. Access is only granted to one specific user account at a time, and only for a limited amount of time.
4. Access to a user account requires at least one other person to sign off on the access-grant.
5. Every operation performed upon a user account -- viewing a field, modifying a field -- is logged in a place the people from #2 and #4 do not have access to.
6. Access logs are routinely audited for perfidy.
7. Gaining accesses to user accounts or interacting with them in a way that is not necessary or attempting to circumvent the above process must be a don't-bother-cleaning-out-your-desk-we'll-do-it-for-you offense.
With policies in place like that, you reduce the insider risk to user accounts. You need multiple people directly involved in secretly accessing or taking over a user account, and you potentially need dozens of others (the potential auditors) to be complicit. The more people you have involved, the more likely it is someone shuts it down, or at least blows the whistle on it when shit hits the fan.
If someone can just get drunk one night, open up a user account, tweet something, then SSH over to the audit server and drop the rows from the access log indicating what they did, and there's no way to even prove something happened, let alone who did it.
Thing is, now that it’s possible for Twitter, Twitter can never brush off this suspicions again.
We’re literally not sure, by using Twitter, that we see the speech of that person.