Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to send DMs on Twitter without permission

homakov.blogspot.com

Post reply on HN
Print view View original

1–10 of 60 posts

Re: How to send DMs on Twitter without permission

#2

Post by bcardarella »

the 'd' syntax for sending DMs has been around from nearly the beginning (or from the actual beginning?) of Twitter. That in itself is not a bug. However, Twitter should be stripping that leading 'd' from anything that is reposting or from a 3rd party OAauth session.

Re: How to send DMs on Twitter without permission

#3

Post by edent »

It only allows you to send DMs to those users you can already message - which is a small mercy.

This part of Twitter's "Get Better" problem - where they've allowed SMS commands to be activated via non-SMS interfaces - http://techcrunch.com/2012/05/26/twitter-get-better/

Of course, it doesn't help that Twitter's permissions system is really poorly thought out. An app which only wants to read your Tweets also has WRITE access as well.

Re: How to send DMs on Twitter without permission

#4

Post by TillE »

bcardarella wrote: post #2

the 'd' syntax for sending DMs has been around from nearly the beginning (or from the actual beginning?) of Twitter. That in itself is not a bug. However, Twitter should be stripping that leading 'd' from anything that is reposting or from a 3rd party OAauth session.

It's not a bug per se, but it's certainly a hideous misfeature to have ever had that kind of input parsing except on the SMS interface to Twitter. It's just completely unnecessary.

Re: How to send DMs on Twitter without permission

#6

Post by jxf »

People in various forums (a couple on HN, SO, Egor's blog, Twitter itself) seem to be saying something like "this isn't really a bug".

It's definitely a bug. Twitter requires clients to ask for the DM permission before they can send DMs. With Egor's approach, clients can privilege-escalate themselves to send DMs even if they never asked for that permission (although they still need to be authorized to send tweets).

Also, even worse, Twitter doesn't consider it a bug, according to the person who originally reported it (who was not Egor): https://twitter.com/DaKnObCS/status/411869431036653568

And here's a response from Ben Ward, the Twitter web lead: https://twitter.com/benward/status/411924515459850240

Re: How to send DMs on Twitter without permission

#7

Post by the_french »

gkoberger wrote: post #5

This is the same guy who hacked GitHub (and Rails) with the multiple assignment hack, among other things.

I enjoy reading his finds a lot. He tends to find relatively blatant lapses in the various security measures of the sites he investigates.

Re: How to send DMs on Twitter without permission

#8

Post by raverbashing »

bcardarella wrote: post #2

the 'd' syntax for sending DMs has been around from nearly the beginning (or from the actual beginning?) of Twitter. That in itself is not a bug. However, Twitter should be stripping that leading 'd' from anything that is reposting or from a 3rd party OAauth session.

Exactly this

There were worse commands, I remember there was a 'follow' command (not sure it was called like that), twitter disabled this

The d command has some user experience value, however, yes, it makes no sense for twitter to accept it on non twitter apps (meaning, those that don't provide the twitter experience - like mobile clients, tweetdeck, etc)

Post reply on HN