Readit News logoReadit News
hn_throwaway_99 · 3 years ago
Not being a big Twitter user, I didn't understand the whole "blue checkmark verified" scam, which works like this:

1. There are a host of requirements needed to get the blue check: https://help.twitter.com/en/managing-your-account/about-twit...

2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.

3. So the scam is that some bad guy buys a previously verified account, changes the profile pic and display name to someone else famous, then uses it to phish.

#2 is colossally stupid, and is trivial to prevent (lots of dating sites require profile changes and pic changes to be reviewed before going live). Apparently this has been going on a long time so is baffling to me.

tanin · 3 years ago
> However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.

I worked at Twitter and built the verification service. I recalled that this was the case back in 2012. You couldn't change your name or username if you were verified (or if you change one of those, you would lose the checkmark).

chimeracoder · 3 years ago
> You couldn't change your name or username if you were verified (or if you change one of those, you would lose the checkmark).

You still can't change your username. You can change your display name, however, and I believe that's always been the case.

dundarious · 3 years ago
I believe around 2015/2016, a verified account I follow changed his name and avatar (but not username) to "Italian Elon Musk", and a Mario mustache and hat superimposed on Musk's then avatar. He made many posts along the lines of "I skippa tha taxes! Mamma mia!". Pretty obviously a joke, and after a while (I think a few days), he lost his tick, which I think was in a way his goal all along.

So if you're saying such changes for verified accounts have been disallowed since 2012, and if my dates are somewhat accurate, then I don't think that's right. But maybe you're just saying it used to be disallowed around 2012, not that it became disallowed then.

numpad0 · 3 years ago
I can see why that requirement was dropped, because display name is sometime used as a profile line. e.g.:

- “Corporate, Inc. @ tradeShow Hall A”

- “DisplayName / A Trusted Brand”,

- “Individual (LIVE 09/21 21:00-)”, etc.

Profile pics change for similar reasons. screenname(@username) is the only bitwise consistent visual element for a Twitter account so there will have to be either a magical audit algorithms to verify user perceived consistencies for changes, or simply a degraded experiences with impacts on engagements for verified users, to enforce that.

waylandsmithers · 3 years ago
I'm an uncool dad but thought the check mark was like, this account really is the famous person the account claims to be, like Brad Pitt or Oprah. Now it's always someone I've never heard of.
giraffe_lady · 3 years ago
Famous to who though and how famous? I recently clicked through to a profile of someone I had never heard of and they had 5m+ followers. This isn't a "look how out of touch I am with pop culture" humblebrag they were just from a different part of the world, famous in a language I don't speak.

And maybe not too similar but the mayor of my city only has a couple tens of thousands of followers but is definitely known by everyone who lives in it and yes has a blue check.

How famous is famous enough isn't a question with an obvious, or single answer.

chunkyguy · 3 years ago
A famous person in one region is an unknown in another.
cmelbye · 3 years ago
Could they simply disable the ability to change display names for verified users? It must match the government-issued ID / business documents / etc. that were used to verify in the first place. If you want to change it, send updated verification documents.

This takes away an avenue for self-expression (people will often change their display names based on trends, etc.) and might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...

pessimizer · 3 years ago
> Could they simply disable the ability to change display names for verified users?

I don't know if I agree with this solution, but it is bizarre that there are plenty of blue checks where neither their twitter @id nor their display name have anything to do with their actual name. Who is the blue check verifying that they are?

I propose showing the verified identity (whether that's a stage name or whatever) on mouseover on the blue check icon. I'll take my consulting fee through paypal.

tablespoon · 3 years ago
> It must match the government-issued ID / business documents / etc. that were used to verify in the first place. If you want to change it, send updated verification documents.

That seems like a bad requirement, because I'd imagine a lot of these legitimately-verified accounts go by professional names (e.g. actors, authors with a pen name, etc.) not legal names.

miki123211 · 3 years ago
People get verified because they're pretty well known, and people are rarely known by their legal names.

Celebrities are the obvious example, you probably know who Eminem or Lady Gaga are, but very few people know who Marshall Bruce Mathers III or Stefani Joanne Angelina Germanotta are. Others might also want to have their title in there names, for example presidents, professors, kings etc.

_dain_ · 3 years ago
>This takes away an avenue for self-expression (people will often change their display names based on trends, etc.) and might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...

or you know, women changing their surnames after getting married ...

eyelidlessness · 3 years ago
> might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...

Edge cases which can get people irreversibly dead. Doesn’t seem like the right direction to me.

stjohnswarts · 3 years ago
would that be useful if you don't require at least monthly proof?

Dead Comment

bombcar · 3 years ago
Twitter users love changing their profile picture/name to support the current cause of the moment so much that it’s become a meme. Changing that would piss off their active posters.
KerrAvon · 3 years ago
No problem: add a second line with the verified name, or put the verified name in hover text if it differs from the display name. The verified name could still be a pseudonym, but it couldn't change without going through the verification process again.

Also, anyone willing to go through the verification process should get a blue check. Right now it's dependent on some Twitter insider liking the account holder (the insanely bullshit "Notable" requirement).

ben_w · 3 years ago
Annoying such people is probably a price worth paying: https://news.sky.com/story/tories-criticised-for-misleading-...
pawelduda · 3 years ago
Pretty simple to solve - change your profile pic/name, lose blue checkmark until you get verified again.
fknorangesite · 3 years ago
> the current cause of the moment

Doesn't even need to be a cause - it's almost October, which means it's "change it to a spooky pun of your regular name" season.

Dead Comment

pentagrama · 3 years ago
On the Twitter help page it says that your blue check will be removed if you do that.

>If changes to your account are misleading or substantially alter the persona present on your account

https://help.twitter.com/en/managing-your-account/about-twit...

bombcar · 3 years ago
By the time it’s reported and found and handled the damage is done.
omgomgomgomg · 3 years ago
Wow, this is incredible, this would be as if in fintech you let customers change their data of the onboaring information without checking again.
at-fates-hands · 3 years ago
Before I got off of Twitter years ago, friends of mine would make a background image with a blue checkmark and then add it to their profile so it looked like you were verified.

Easier than going through all the channels. Not sure if this still works, but a clever hack to get around (at the time) a very long process to get your identity verified.

landr0id · 3 years ago
>2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.

afaik twitter will remove your verification status if you do this maliciously. Like trying to impersonate a famous person and make it look like they're saying something stupid.

datagram · 3 years ago
Yeah but as the OP shows, this probably happens much too late to stop harm if it happens at all.

Just checked, and the account from the screenshot is still around and still verified.

ryan29 · 3 years ago
It's not a very good system either because it's called verification, but it's actually indicating popularity or notoriety. People hear "verified" and correlate that with trustworthiness when all that check mark is really indicating is "this person appears to be famous."
godelski · 3 years ago
About once a week I get a mass message from a random twitter account with extremely clear spam (they even leave the group message after they send it!). They are often centered around crypto. I don't know how they are this bad because a Naive Bayesian Classifier could block this stuff.
Jerrrry · 3 years ago
4. Repeat steps 1-3 for non-verified users

5. Report targeted user for mimicry/impersonation.

6. Targeted user gets insta-banned.

summerlight · 3 years ago
https://help.twitter.com/en/managing-your-account/about-twit...

> If changes to your account are misleading or substantially alter the persona present on your account

You will lose the badge if you try to do the 2nd. But currently it doesn't proactively apply preventative measures, which is definitely a problem. Twitter obviously doesn't have bandwidth to proactively prevent all those scams, but at least last reviewed profiles should be visible to users for verification.

loeg · 3 years ago
Step 2.5 is probably the bad guy hacks some existing blue-checkmark account, but yeah.
system16 · 3 years ago
Comically, when I view this tweet in my browser, at the top right in the "Relevant people" box that Twitter wants me to pay attention to and follow is _another_ fake yet verified Vitalik account.

Honest question: what do Twitter's army of engineers and designers actually do every day? The site is slow, the UI is god awful, and the spam is - as this tweet points - appalling.

gnicholas · 3 years ago
They're building and A/B testing the new features that blocks you from using the site when you're not logged in, and force you to hand over your phone number if you want to create or use an account.
honkdaddy · 3 years ago
I've told this story before, but one of my college buddies is an ex-Twitter engineer and I can anecdotally answer this question.

He worked about 2h/day. When he _was_ working, it was on a 5 person team whose sole job that quarter was to implement (from scratch) some JS games and stress relief activities to be played by their content moderation staff in their mandated 10min breaks every 30min.

He was on the team for probably 5 months before he quit and found another job to continue coasting at, and not once in the whole 5 months did their team deliver anything tangible. From what I understood this sort of dynamic was pretty par for the course at Twitter.

I imagine in 50 years companies like Twitter will be used as case studies in business school for how chronically woke-obsessed middle management and career political justice warriors had a measurable tendency to kill otherwise profitable companies in the 2010s-30s. There is just 0 financial justification for the business and management frameworks put forward by these folks, and getting to peer into the Twitter corporate chat, team makeups, hiring processes, and general political climate made it clear to me how much poor money is being spent at many of these companies, and that when the song eventually ends, I'm certainly not hoping to be the one holding the bag.

iLoveOncall · 3 years ago
> what do Twitter's army of engineers and designers actually do every day?

They work on more dark patterns to force you to give your phone number or to create an account to read a tweet.

cowtools · 3 years ago
Yes, as someone who does international travel and frequently switches phone numbers, dealing with phone-based 2FA """security""" is a major problem for me. At least I will not waste time on their website.

I just never give my phone number out anymore, no matter what because it will be used against me. Even google is trying to hold my account hostage, luckily they have an email forwarding feature so I no longer need to log in.

sbierwagen · 3 years ago
>and the spam is - as this tweet points - appalling.

Incentives. If the expected value of a single spam message is in the micropennies, then you have to send enormous volumes of them, which can easily be detected by automated tools.

Cryptocurrency changes this. Now an account hack can net the attacker millions of dollars. This means you can send many fewer messages and invest much more time in each of them.

iudqnolq · 3 years ago
My favorite example of that is that the people you might want to follow box recommends people you're following already.
icehawk · 3 years ago
I love it when it suggests people I've blocked. A $32 billion company and they don't realize there's no intersection between people i've blocked and people i want to follow.
mousetree · 3 years ago
You still might want to follow the people you're already following
itsoktocry · 3 years ago
>The site is slow, the UI is god awful, and the spam is - as this tweet points - appalling.

I've probably used Twitter for 1 hour+ per day, every day, for years. I hardly even notice the spam. What am I doing wrong? Is it targeting specific niches? Clearly something is working.

paulgb · 3 years ago
Nor sure why you’re being downvoted, it’s perfectly possible to never encounter this stuff on Twitter. If you encounter tweets by crypto-adjacent people (Elon Musk, etc.) or that mention crypto themes, and view the replies, you’ll easily find spam, but if you don’t do that you might never encounter it.
jay_kyburz · 3 years ago
I get some notification spam. Like this.

Like this https://twitter.com/mdj7282/status/1563203203490992128

madeofpalk · 3 years ago
Heh - in the Relevant people box I've started getting people who I've blocked, and have blocked me!

Deleted Comment

claytongulick · 3 years ago
Activism.

Dead Comment

bombcar · 3 years ago
YouTube has suddenly encountered a rash of “comment reply scam/spam” where if you reply to a famous YouTuber someone with the same profile picture will reply almost instantly with a generic thank you / won a prize type comment and try to get you to use telegram or discord. It’s all so pitiful.

As for Twitter the check mark might actually be useful if it disappeared the moment you changed your “display name” but we can’t have that!

bko · 3 years ago
The worst thing is that the workflow to report spam has gotten a lot worse since the last 6 months. Now it takes 9 clicks

1. three dots

2. report spam

3. welcome message start report

4. who is this report for? myself, some specific group, everyone (??)

5. general info (attacked b/c of identity, harassed, spam, ... )

6. how is he doing this? (Posting misleading or deceptive links, leading to scams, phishing, or other malicious links, +6 more similarly verbose)

7. yes continue

8. submit

9. done

It used to be like 2 or 3 about 6 months ago but I remember after Musk started complaining they responded by somehow making it worse.

Also most of the reports are centered around harassment or racist comments when 90% of the bad content on twitter most people deal with is straight up scams. There should just be a big this is spam button.

drtz · 3 years ago
My pessimistic view: making it too easy to report spam may highlight how much spam there actually is on Twitter. Something the company definitely does not want to do at the moment.
hellomyguys · 3 years ago
There's a downside to making it easy to report content. You just end up with a bunch of useless reports.
alecco · 3 years ago
In the past year I reported many of these. The most common pattern was some WhatsApp number with funny characters. In most cases the message stays there.

I can't believe it's not easy to filter those. Who uses 10 consecutive weird chars in a message of 15 chars? And most of those are numbers.

I stopped reporting because clearly YouTube doesn't care. And there was a more clear case a couple of years ago with inappropriate comments using sexualized emojis. YouTube did nothing until the outrage got to the press. It's like they only focus in finding excuses to demonetize people leaning into wrongthink.

numpad0 · 3 years ago
Because kids, genuinely autistic engineers, politically inclined, and scammers alike were using it as a super-block and were also scripting it.

Say something “offensive” to the right person, and your account is frozen by the end of the day.

anvic · 3 years ago
How much do you get paid to do content moderation for Google? It may be a good side hustle if the pay is good.
geerlingguy · 3 years ago
I just got my channel added to an 'alpha' of their new spam prevention algorithm... and it seems to be working so far (fingers crossed).

I was getting around 300 spam replies to comments on my videos per week up until the alpha started—now I'm getting 0. So maybe they finally cracked that nut, but I won't count my chickens before they're hatched.

I still run YT-Spammer-Purge[1] daily, but it's come up dry for the past week now.

[1] https://github.com/ThioJoe/YT-Spammer-Purge

cwkoss · 3 years ago
> As for Twitter the check mark might actually be useful if it disappeared the moment you changed your “display name” but we can’t have that!

That would be a very smart policy, but twitter is too afraid of inconveniencing psuedojournalist professional hand wringers and their pressing need to update their display names with the emoji that shows they Care about the important issue of the month.

Or to be even more blasphemous, perhaps Twitter should hire humans to review changes to bluechecks' display names.

lbriner · 3 years ago
Then here's an idea. Have a profile picture and have a person picture. You can change one and not the other.

You're welcome Twitter, no need to thank or pay me (unless you want to of course!)

wnevets · 3 years ago
Games Nexus did an entire video [1] about it and even paid the scammer. Apparently the scammers heavily downvoted the video.

[1] https://www.youtube.com/watch?v=DqPPWO7kWu4

iLoveOncall · 3 years ago
> As for Twitter the check mark might actually be useful if it disappeared the moment you changed your “display name” but we can’t have that!

Just requiring 2FA for checkmarked accounts and an ID confirmation to remove said 2FA would eliminate 90% of the scams already.

Aunche · 3 years ago
I'm also seeing a lot of spam comments pretending to be organic conversation about the market, which eventually leads to you to a "financial advisor" with an oddly unique name that is easy to Google, which leads you to a sketchy website.
badwolf · 3 years ago
Similarly on Instagram it's the sudden slew of "promote it on <spamaccount>" type comments. Dozens of them within minutes of posting anything.
RicoElectrico · 3 years ago
And "+18" profiles viewing your Stories, with links to shady sites in the bio.

They're so similar to each other that manual rules would suffice to cull them, AI my ass.

asddubs · 3 years ago
youtube is a pit of spam in general. Basically any bigger video, every single comment that's even just somewhat high up either has a respond that says something like "check this out <video link>" or "see here <video link>", or a comment left by someone with a username along the lines of "click my profile picture for my pics" with a suggestive avatar
cwkoss · 3 years ago
The vitalik spoofing spam bots are such low hanging fruit. They should really just auto shadow ban anyone using his profile picture besides the real vitalik. (And probably elon musk too..)

I wonder if its an issue of being tangled up in internal bureaucracy, or not wanting to implement one-off solutions to glaring issues that can't be generalized. Certainly a management failure somewhere.

iudqnolq · 3 years ago
I suspect it's because there are many completely different Twitter "communities". The obvious stuff you see all the time is completely different from the low hanging fruit I'd list off.

I do wish they'd ban blue emojis at the start and end of display names. I see that all the time logged in or logged out.

bombcar · 3 years ago
They’d just change the image and name slightly to pass the filters.
cwkoss · 3 years ago
There are a number of well established image similarity algorithms that could be used past simple equality.
mattnewton · 3 years ago
Still making it so easy that they can have literally his name and photo with a blue check mark seems sloppy to me?
pessimizer · 3 years ago
Literally 4chan 101.
smitop · 3 years ago
I've seen impersonation bots that add random noise to the profile picture of the user they're impersonating, so it's possible that Twitter is already doing something like that (just with a similarity threshold too low).
rajeshp1986 · 3 years ago
what if real Vitalik decides to put the picture of a dog on his profile pic? It would effectively shadow ban every user who has a dog picture.
mattgreenrocks · 3 years ago
Cynical me is surprised the "blue checkmark = credibility" thing is starting to crumble. (Actual me can't help smile a bit.)

However, I don't know what they can do here. They set up the system where the users respond to blue checkmarks positively. Adding another layer of blue checkmark is confusing and silly, but having it be gamed is also not good.

Beltalowda · 3 years ago
The funniest part is that one of these spam accounts actually replied with the same spam facepalm. Lots of replies, all from what seem bot/spam accounts.

The (verified) account bio is "Official Account of the Directorate of School Principals, School Supervisors, and Tendik, Directorate General of GTK, Ministry of Education and Culture, Research and Technology" (translated from Indonesian). It's probably a legit account that got compromised; tweets from a few days ago are all fine (and about Indonesian politics and the like).

So basically, the problem isn't really with the blue checkmark as such; it's useful to verify this is an official government account rather than some random guy; the problem is this account got compromised somehow.

lolinder · 3 years ago
Compromised or not, the blue checkmark is completely meaningless if you can change display names and not have to re-verify your account. Profile pictures I can see allowing for convenience, but what is the blue checkmark supposed to be certifying if not the person's name?
lanstin · 3 years ago
And reporting "account taken over" is apparently not an option-niece had her account taken over on Instagram and I couldn't report it (the person started trying to get me to add an email to my insta account) as "account taken over" but only as "fraudulent account." Actual social accounts should be able to use ones contacts to verify account take-over and return it to the correct owner.

For the people reporting these things on twitter, there is also "report an account" which is less clicks.

cinntaile · 3 years ago
The solution is obvious, you get a golden checkmark if you're super verified.
jeffrallen · 3 years ago
Extra verified (EV). Worked great for TLS (eye roll).
convery · 3 years ago
The whole "verified person" / "credible account" went out the window years ago when it became a "twitter approved politics" badge. Remember when the drama around 'SJW's were at its height, people started creating obviously fake accounts and spamming the talking points (e.g. #killallmen) to get their accounts verified..
orblivion · 3 years ago
Make it so that when they change their photo or display name or anything like that, they lose their blue checkmark, or maybe the blue checkmark has like a big question mark over it or something, until they get verified again.
mattgreenrocks · 3 years ago
I like this: changing photo/display name puts them in the checkmark verification queue. Also, turnaround time is a minimum of 72 hours. Until then, the previous details are displayed.
smoe · 3 years ago
My problem with twitter is not even user spam, but twitters own engagement spam, it seems to be impossible to just see the content of people I follow

I recently signed up first time after like 8 years to follow a handful of interesting accounts. But only maybe 20% of stuff I see is actually from them, the rest is all suggestions by twitter what people/topics I should follow or what people that the people I follow follow posted, etc. And there only seems to be ways to show "fewer" of something, not get rid of it altogether. Completely useless. I reckon there are third party apps and browser extensions to filter this, but since I don't care about those few accounts I follow enough either, I couldn't be bothered and deleted my account again.

numpad0 · 3 years ago
Latest temporary mitigation snakeoil is searching for “filter:follows -filter:replies include:nativeretweets” and using that search page as home timeline.

Following one used to work, for reference: https://gist.github.com/IanColdwater/88b3341a7c4c0cf71c73ac5...

fknorangesite · 3 years ago
You can switch between "Home" (default, what you're describing) and "Latest" (what you want) feeds.

I'm not sure about a mobile app, if that's what you're using, but on web at least it's the stars-icon-button in the top right of the feed.

patch_cable · 3 years ago
Mobile app works the same way. Twitter is basically unusable to me without changing this setting.
cxr · 3 years ago
> I recently signed up first time after like 8 years to follow a handful of interesting accounts

I've done that a few times over the years and have always later ended up deleting my account for the same reason I didn't have one in the first place. Then I realized how silly it is to sign up to follow someone when you can just bookmark their profile and check up on them every now and then—the same way anyone not using RSS would "follow" the Web sites they were interested in ~15 years ago.

knocknock · 3 years ago
if you switch from the "Home" timeline to the "Latest Tweets" timeline, you should only see things from people you follow.
dotnet00 · 3 years ago
The only way Twitter is usable to me is using the 'Better Twitter' browser extension, which filters out most of their recommendation stuff.
mzs · 3 years ago
I think twitter wants you to make a list for that.
orblivion · 3 years ago
Looks like the spammers noticed Paul's tweet https://twitter.com/kspstk_gtk/status/1570094371009069056 lol
bitwize · 3 years ago
One of the bots is named AberBluehair. There's something very "how do you do, fellow young people" about that.

    HELLO. THIS IS MARY. I AM A HUMAN WITH SOFT SKIN.
https://www.penny-arcade.com/comic/2000/01/28/move-over-hell

_Adam · 3 years ago
That profile in particular is interesting. The first two tweets appear to be human originated, and date from December 2021. There are no tweets from the account until seven hours ago, and all the tweets after that point are spam.

Several options:

* Spammers creating accounts and posting human posts in advance knowing they'll be used for spam in the future

* Account sold by the actual owner

* Account compromised and repurposed for spamming

nneonneo · 3 years ago
It’s amusing to me that they end each fake reply with a string of four random letters. What better way to scream “I’m a bot”?
dr_kiszonka · 3 years ago
I wonder what these strings are. Some sort of an ID? Or maybe to make these tweets sufficiently different from each other to avoid triggering spam detection?

Deleted Comment

Deleted Comment

101008 · 3 years ago
How did they get the blue checkmark on Twitter? It is really hard to get one honestly (I applied a few times showing that my "brand" was quoted/linked on Wikipedia and several large media outlets) - unless they are paying several thousands (which I don't think this is the case)
itslennysfault · 3 years ago
You can just buy one. You're allowed to change your name, profile, picture without losing the blue check. So if you buy (or steal) an existing account you can just update it to whatever you want and keep the check.
arcticbull · 3 years ago
There's a whole crypto scam industry where hackers/scammers will sell accounts they've taken over to folks who immediately start shilling NFTs and pump/dump coins.

The economics of it are interesting, the accounts can be expensive. But it must work out otherwise nobody would do it.

acomjean · 3 years ago
There was a post on HN in the past month about people using music and self publishing to get that blue check.

See:

https://news.ycombinator.com/item?id=32662123

(edit: that was instagram, but its probably the same idea..)

djbusby · 3 years ago
Yeah, my old account, for a business, valid trademark, etc - check box rejected :(
iLoveOncall · 3 years ago
It's a hacked account that got rebranded.
MattGaiser · 3 years ago
I am surprised you can rebrand without redoing verification.