Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter blocked my account for a tweet I did not make

jacquesmattheij.com

Post reply on HN
Print view View original

151–160 of 276 posts

Re: Twitter blocked my account for a tweet I did not make

#151

Post by oh_sigh »

jacquesm wrote: post #14
powera wrote: post #13

If you don't use Two-Factor Authentication, and you have a public profile, the question isn't if your account will be compromised, but when . Apparently, for Mr. Mattheij, when was today. The next question is "how do you safely recover your account". Hopefully this is a straightforward process, considering you have access to the email account associated with your Twitter account. Of course, Twitter needs to make sure…

There is no way that my account password was compromised without a much more elaborate hack of Twitter, either that or someone social engineered them to change my password.

Or you just accidentally typed your password into the wrong site, perhaps via phishing?

Believing you weren't/couldn't be phished is a great way to get phished again...

Re: Twitter blocked my account for a tweet I did not make

#152

Post by LightG »

jacquesm wrote: post #89
LightG wrote: post #85

With the greatest respect. Who cares? It's twitter. A cesspit, now run by raggety old billionaire on an ego trip. Don't like it. Leave and find somewhere better!

I care because I have about 11K followers there and apparently someone is able to write stuff that looks like I wrote it and that opens me up to all kinds of damage. So this may not be a 'big deal' to you but it is to me.

I do understand, but this was always the trap ... and you signed up to it.

I don't blame you, but I sort of do.

These are behemoths where you are the product.

Don't be surprised when things go awry with not the slightest care in the world by said behemoth about you.

Re: Twitter blocked my account for a tweet I did not make

#153

Post by latchkey »

jacquesm wrote: post #120
latchkey wrote: post #113

Earlier quoted context omitted.

Wow, TIL that you don't have a smart phone, so interesting! Anyway, twitter has had app based 2FA since the end of 2017... https://techcrunch.com/2017/12/20/twitter-adds-support-for-a... A year ago, they added security key support: https://9to5mac.com/2021/06/30/twitter-users-can-now-add-sec... You don't need a phone to have security.

I don't have a smartphone specifically because I believe they are insecure by design, at least one company and a whole raft of employees there have access to it and that's before we get into automatic updates of the software on those devices and so on. When I say I'm pretty sure that this machine wasn't compromised that is because I'm utterly paranoid when it comes to stuff like this. Possibly not paranoid enough - g…

Where do you back up your passwords?

(don't answer that, just something to think about)

These days, you can never be too paranoid. I religiously 2FA all my accounts the moment I create them.

Re: Twitter blocked my account for a tweet I did not make

#154

Post by bink »

jacquesm wrote: post #132
mort96 wrote: post #125

> Twitter believes that I should delete the Tweet (which I didn’t make in the first place) But... It's on your account. If Twitter's condition for re-instating the account is that you delete this tweet, and you have enough access to your account to be able to delete the tweet, why aren't you deleting the tweet? And: > Twitter is behaving wholly irresponsible here: there is absolutely no way that if my account was com…

> why aren't you deleting the tweet? Because deleting it would remove the one bit of evidence that this happened and may well wipe out the data that would allow establishing how this was done. > What if someone got hold of your password somehow? Theoretically possible, practically not very likely for all kinds of reasons which I won't go into here but which you are going to have to take my word for. Let's just say th…

> Because deleting it would remove the one bit of evidence that this happened and may well wipe out the data that would allow establishing how this was done.

You say you've been around awhile but you don't seem to understand that there is not such thing as permanent deletion when it comes to social media. "Deleting" the post in this case would only mark it as deleted and remove it from people's feeds. There is no destruction of evidence that would prevent Twitter from investigating the tweet in the future.

Re: Twitter blocked my account for a tweet I did not make

#156

Post by Jenya_ »

jacquesm wrote: post #141
Jenya_ wrote: post #131

Earlier quoted context omitted.

Tweet is addressed to several accounts, one of them is KyivIndependent which reports Ukraine related news. The tweet looks like a death wish from RU supporter.

So it wasn't as a reply to anything? Pretty weird. I'm about as far from a RU supporter as it gets, as my very extensive tweet history amply documents. But it would be a pretty good way to discredit me.

I agree, this looks like a quick and dirty attempt to get account blocked.

Re: Twitter blocked my account for a tweet I did not make

#157

Post by jacquesm »

bink wrote: post #154
jacquesm wrote: post #132

Earlier quoted context omitted.

> why aren't you deleting the tweet? Because deleting it would remove the one bit of evidence that this happened and may well wipe out the data that would allow establishing how this was done. > What if someone got hold of your password somehow? Theoretically possible, practically not very likely for all kinds of reasons which I won't go into here but which you are going to have to take my word for. Let's just say th…

> Because deleting it would remove the one bit of evidence that this happened and may well wipe out the data that would allow establishing how this was done. You say you've been around awhile but you don't seem to understand that there is not such thing as permanent deletion when it comes to social media. "Deleting" the post in this case would only mark it as deleted and remove it from people's feeds. There is no des…

I would not make any assumptions about implementation details to which I have no access.

Re: Twitter blocked my account for a tweet I did not make

#158

Post by jacquesm »

scarmig wrote: post #149
jacquesm wrote: post #132

Earlier quoted context omitted.

> why aren't you deleting the tweet? Because deleting it would remove the one bit of evidence that this happened and may well wipe out the data that would allow establishing how this was done. > What if someone got hold of your password somehow? Theoretically possible, practically not very likely for all kinds of reasons which I won't go into here but which you are going to have to take my word for. Let's just say th…

I do trust that you have better opsec than 99%+ of users and that you didn't write this tweet. But it seems incredible that an adversary would burn a Twitter vulnerability to post a near incoherent message from your account (which isn't particularly influential, as far as these things go). Even social engineering Twitter support seems like a really crappy effort/reward ratio. What you're doing here makes sense, and i…

Yes, that is the thing that really gets me: if this isn't widespread - and I have no indication so far that it is - then either this was a trial balloon and it backfired because I'm the wrong target to do that to or someone got supremely stupid and tipped their hand. One HN user below had a good idea on how to figure out if the password was unchanged and as far as I can see that is the case, which only makes this more of a puzzle.

Re: Twitter blocked my account for a tweet I did not make

#159

Post by jacquesm »

tedivm wrote: post #148
jacquesm wrote: post #132

Earlier quoted context omitted.

> why aren't you deleting the tweet? Because deleting it would remove the one bit of evidence that this happened and may well wipe out the data that would allow establishing how this was done. > What if someone got hold of your password somehow? Theoretically possible, practically not very likely for all kinds of reasons which I won't go into here but which you are going to have to take my word for. Let's just say th…

> Because deleting it would remove the one bit of evidence that this happened and may well wipe out the data that would allow establishing how this was done. That's not how computers work. You'll mark it as deleted and then the "deleted" column (or field or whatever) will turn from false to true. No forensic evidence will be lost.

Unless you work for Twitter and know how they have implemented this feature I don't think you can make that call. Based on things that have happened to Twitter in the past I think assuming sane implementations is something that I would not immediately do.

Re: Twitter blocked my account for a tweet I did not make

#160

Post by mort96 »

jacquesm wrote: post #14
powera wrote: post #13

If you don't use Two-Factor Authentication, and you have a public profile, the question isn't if your account will be compromised, but when . Apparently, for Mr. Mattheij, when was today. The next question is "how do you safely recover your account". Hopefully this is a straightforward process, considering you have access to the email account associated with your Twitter account. Of course, Twitter needs to make sure…

There is no way that my account password was compromised without a much more elaborate hack of Twitter, either that or someone social engineered them to change my password.

I'm not saying this is what happened, but compromising your e-mail is also a possibility.

Also, I'm not sure how you can say "there is _no way_" your account password was compromised. Can you know for certain that you haven't ever executed code which couldn't potentially be malicious or have security issues? Hell, if you use a web browser there's a non-zero chance that some website you visited was compromised to serve you some javascript which exploits a zero-day in whatever browser you use. You can say that's unlikely, but there's a lot of possible scenarios like that, and you're worryingly willing to just dismiss them all and say there's _no way_ this could be anything other than a vulnerability on Twitter's side.

Post reply on HN