Hacker News Reader

Comment by hn_throwaway_99 | Hacker News Reader

Not being a big Twitter user, I didn't understand the whole "blue checkmark verified" scam, which works like this:

1. There are a host of requirements needed to get the blue check: https://help.twitter.com/en/managing-your-account/about-twit...

2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.

3. So the scam is that some bad guy buys a previously verified account, changes the profile pic and display name to someone else famous, then uses it to phish.

#2 is colossally stupid, and is trivial to prevent (lots of dating sites require profile changes and pic changes to be reviewed before going live). Apparently this has been going on a long time so is baffling to me.

View on HN

> However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.

I worked at Twitter and built the verification service. I recalled that this was the case back in 2012. You couldn't change your name or username if you were verified (or if you change one of those, you would lose the checkmark).

> You couldn't change your name or username if you were verified (or if you change one of those, you would lose the checkmark).

You still can't change your username. You can change your display name, however, and I believe that's always been the case.

I believe around 2015/2016, a verified account I follow changed his name and avatar (but not username) to "Italian Elon Musk", and a Mario mustache and hat superimposed on Musk's then avatar. He made many posts along the lines of "I skippa tha taxes! Mamma mia!". Pretty obviously a joke, and after a while (I think a few days), he lost his tick, which I think was in a way his goal all along.

So if you're saying such changes for verified accounts have been disallowed since 2012, and if my dates are somewhat accurate, then I don't think that's right. But maybe you're just saying it used to be disallowed around 2012, not that it became disallowed then.

Yes, I was saying it was like that in 2012. They probably changed it after 2015.

I can see why that requirement was dropped, because display name is sometime used as a profile line. e.g.:

- “Corporate, Inc. @ tradeShow Hall A”

- “DisplayName / A Trusted Brand”,

- “Individual (LIVE 09/21 21:00-)”, etc.

Profile pics change for similar reasons. screenname(@username) is the only bitwise consistent visual element for a Twitter account so there will have to be either a magical audit algorithms to verify user perceived consistencies for changes, or simply a degraded experiences with impacts on engagements for verified users, to enforce that.

I'm an uncool dad but thought the check mark was like, this account really is the famous person the account claims to be, like Brad Pitt or Oprah. Now it's always someone I've never heard of.

Famous to who though and how famous? I recently clicked through to a profile of someone I had never heard of and they had 5m+ followers. This isn't a "look how out of touch I am with pop culture" humblebrag they were just from a different part of the world, famous in a language I don't speak.

And maybe not too similar but the mayor of my city only has a couple tens of thousands of followers but is definitely known by everyone who lives in it and yes has a blue check.

How famous is famous enough isn't a question with an obvious, or single answer.

My brother in law has a blue check. He writes comic blogs and wrote a book about them, so he does have a public persona. But he has less than 5000 followers and he is certainly not famous.

Also a bunch of early Twitter employees or their friends with low-follower Verified accounts. It's not consistent.

A famous person in one region is an unknown in another.

Could they simply disable the ability to change display names for verified users? It must match the government-issued ID / business documents / etc. that were used to verify in the first place. If you want to change it, send updated verification documents.

This takes away an avenue for self-expression (people will often change their display names based on trends, etc.) and might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...

> Could they simply disable the ability to change display names for verified users?

I don't know if I agree with this solution, but it is bizarre that there are plenty of blue checks where neither their twitter @id nor their display name have anything to do with their actual name. Who is the blue check verifying that they are?

I propose showing the verified identity (whether that's a stage name or whatever) on mouseover on the blue check icon. I'll take my consulting fee through paypal.

Sometimes people are famous under a username or pseudonym. Also Twitter generally verifies people at risk of being impersonated. It doesn't matter if you know who say CZ is but if thousands of people would pretend to be him and others will fall for it it helps to verify who the real one is.

Though clearly they should disable name changing post verification or something so the checkmark itself doesn't help to impersonate others.

And sometimes famous blue checks have an id that is unrelated to any name they have been known by, and a display name unrelated to any name they have been known by. I know this because I follow people like this. I know who they are verified to be, but that name is nowhere associated with their account.

Which is why I said that.

Well, it kind of makes sense if you have e.g. a big youtube channel under and alias and people would know who you are based on that (e.g. Veritasium) but less people would know what your actual name is. However I don't use twitter so I have no idea how liberally this sort of thing is applied

Another example would be MrBeast. His real name is Jimmy Donaldson but few people know him by that name.

yeah I mean it's true of basically any youtuber whose handle isn't just their name

> Who is the blue check verifying that they are

This is exactly my issue with the whole phenomena. They're utterly useless as anything but a weird form of status symbol.

Hell, Twitter may as well sell them, might help with the revenue issue.

Musk proposed that. Making the verification process more elaborate and less fame-oriented, and charging for it.

Now I have to rethink this. If d00dly agrees with the idea, it is likely half-baked and missing something obvious.

> It must match the government-issued ID / business documents / etc. that were used to verify in the first place. If you want to change it, send updated verification documents.

That seems like a bad requirement, because I'd imagine a lot of these legitimately-verified accounts go by professional names (e.g. actors, authors with a pen name, etc.) not legal names.

A sane policy would be that there's a process for verified accounts to change their name, and that process is that some human at Twitter sees the account's current name and new name and rejects changes that aren't obviously still "the same person." A policy like this could prevent these kind of "pretend to be Vitalik or Elon or whoever" schemes without actually having to review the verification itself.

So you can still allow hashtags and emoji and so on being stuck onto names, still allow "spooky" Halloween names, but preserve some kind of value from the verified checkmark.

I don't know how many verified users there are but this doesn't seem like it would necessarily be onerous. Of course, it's still more onerous than just doing nothing about it is.

You can be flexible in the initial validation - it's reasonable to allow William Jefferson Clinton to go by Bill Clinton if he wants to.

And it's reasonable to allow name changes - it's not unusual for people to get married, or for companies to rebrand.

But why let people change names without repeating the validation process? It's not like people are getting married several times a year or anything like that.

I think business documentation in these cases is obvious choice. So you present good enough claim to that name or what ever and you get verification. This however means it is not personal account, but tied to that name or entity. Whoever owns it.

So government ID + some reputable source (news article, etc.) that links your real name to your professional name, and then it can’t change.

There is Facebook for that, used by no one.

Facebook policy is to require a real name for every user. I'm struggling to see how that's relevant here.

If you want to tweet under an anonymous pseudonym -- great! We are talking about an optional verification feature for a subset of users who are at risk of impersonation. These people choose to participate in this program because they want their identity to be clear and legitimate.

Maybe I've seen less Twitter users that satisfy (famous && real name && at risk) than normally observed...

People get verified because they're pretty well known, and people are rarely known by their legal names.

Celebrities are the obvious example, you probably know who Eminem or Lady Gaga are, but very few people know who Marshall Bruce Mathers III or Stefani Joanne Angelina Germanotta are. Others might also want to have their title in there names, for example presidents, professors, kings etc.

True, and there should be a way for people to get verified and use their professional / public persona names as Verified Identities.

They just don't get to change the name or image on the account without going through a manually verified update process. Pretty trivial, a singer goes on a new tour and wants to use a new headshot, checks out faster than reading this paragraph. A cracker hijacks the account and wants to change it to Vitalik Buterin, also pretty obvious to deny, as this is clearly a different identity inconsistent with the previous one.

That isn't always easy to verify though if you aren't familiar with the person, their public image, and their current events.

For example if Ed Sheeran changes their profile picture to an X, how do you know he means his Multiply album and not some terrible Lil Nas X impersonation. What about if a performer changes their stage name? Can we reliably expect Twitter research this change and know that its the same person?

>>Can we reliably expect Twitter research this change and know that its the same person?

Um, yes — it is their job. Most will be easy and some will be harder.

I understand that some small subset of people can have different public-facing roles. Perhaps the solution is to allow two accounts for each? After all, one can have one for your person and one for your company.

>This takes away an avenue for self-expression (people will often change their display names based on trends, etc.) and might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...

or you know, women changing their surnames after getting married ...

> might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...

Edge cases which can get people irreversibly dead. Doesn’t seem like the right direction to me.

would that be useful if you don't require at least monthly proof?

Twitter users love changing their profile picture/name to support the current cause of the moment so much that it’s become a meme. Changing that would piss off their active posters.

No problem: add a second line with the verified name, or put the verified name in hover text if it differs from the display name. The verified name could still be a pseudonym, but it couldn't change without going through the verification process again.

Also, anyone willing to go through the verification process should get a blue check. Right now it's dependent on some Twitter insider liking the account holder (the insanely bullshit "Notable" requirement).

> or put the verified name in hover text if it differs from the display name

This isn't really a solution, because it's already "obvious" that it's the wrong user if you're looking closely. The UI shows "Vitalik.eth [verified checkmark] @scamusername" so you can see that @scamusername is not @vitalik. The problem is that you shouldn't need to look at the light text or hover to see that a verified user is who they say they are, the UI should make it completely clear.

This is already the case, the verified name is the account name, which is always displayed just below the nickname. What's your plan? Add a 3rd name?

This is obviously not true, unless I'm misunderstanding something. I'm not a twitter scientist, but I don't know what an "account name" is, unless it's the twitter handle. The twitter handles of blue checks are verifiably not required to have any relationship to a name that anyone knows them by, so are not a "verified name."

> I don't know what an "account name" is, unless it's the twitter handle

So, you know perfectly well and understood perfectly my point.

Remove nicknames.

“There are 44,935 people named John Smith in the United States.”

https://alexaanswers.amazon.com/question/24Ryred578w14fHwRNC...

You'd still have edge cases where a change in verified name is needed (marriages, avoiding deadnaming, etc). A solution like this might narrow the problem space, but it doesn't solve the issues.

Annoying such people is probably a price worth paying: https://news.sky.com/story/tories-criticised-for-misleading-...

Pretty simple to solve - change your profile pic/name, lose blue checkmark until you get verified again.

That would kill a lot of Twitter culture though (for better or worse). Changing a name for "spooky season", updating a profile pic to promote a new event, etc. It also would make it risky for a large company to change their logo (if Volvo loses verification for a few days it opens them up to a ton of scams).

Seems like a minor inconvenience compared to what's going on right now. Maybe allow changing avatar without losing the badge but not the name.

This is kind of how Scruff (gay dating app) works. Change your profile pic? Lose your verified status and have to go thru verification again.

> the current cause of the moment

Doesn't even need to be a cause - it's almost October, which means it's "change it to a spooky pun of your regular name" season.

On the Twitter help page it says that your blue check will be removed if you do that.

>If changes to your account are misleading or substantially alter the persona present on your account

https://help.twitter.com/en/managing-your-account/about-twit...

By the time it’s reported and found and handled the damage is done.

Wow, this is incredible, this would be as if in fintech you let customers change their data of the onboaring information without checking again.

Before I got off of Twitter years ago, friends of mine would make a background image with a blue checkmark and then add it to their profile so it looked like you were verified.

Easier than going through all the channels. Not sure if this still works, but a clever hack to get around (at the time) a very long process to get your identity verified.

>2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.

afaik twitter will remove your verification status if you do this maliciously. Like trying to impersonate a famous person and make it look like they're saying something stupid.

Yeah but as the OP shows, this probably happens much too late to stop harm if it happens at all.

Just checked, and the account from the screenshot is still around and still verified.

It's not a very good system either because it's called verification, but it's actually indicating popularity or notoriety. People hear "verified" and correlate that with trustworthiness when all that check mark is really indicating is "this person appears to be famous."

About once a week I get a mass message from a random twitter account with extremely clear spam (they even leave the group message after they send it!). They are often centered around crypto. I don't know how they are this bad because a Naive Bayesian Classifier could block this stuff.

4. Repeat steps 1-3 for non-verified users

5. Report targeted user for mimicry/impersonation.

6. Targeted user gets insta-banned.

https://help.twitter.com/en/managing-your-account/about-twit...

> If changes to your account are misleading or substantially alter the persona present on your account

You will lose the badge if you try to do the 2nd. But currently it doesn't proactively apply preventative measures, which is definitely a problem. Twitter obviously doesn't have bandwidth to proactively prevent all those scams, but at least last reviewed profiles should be visible to users for verification.

Step 2.5 is probably the bad guy hacks some existing blue-checkmark account, but yeah.

Reply on news.ycombinator.com