Twitter Used Two-Factor Login Details for Ad Targeting
Twitter was fined $150 million for using phone numbers and email addresses collected for two-factor authentication for ad targeting.
Comments
lurker • June 9, 2022 2:08 PM
The greatest targeted advertiser Google keeps asking me for my phone nr. “to improve account security”. They ain’t gettin’ it from me.
For “account security” G has also just shut out all non-G apps and OS from simple username-password access to gmail. To setup Oauth2 requires initiating a “Project” on Google Cloud . . .
The same sort of fines should go to the companies uploading their email/phone databases to Twitter.
I expect they also upload them to Google, Facebook, Amazon, and everywhere else.
So if you think Google doesn’t already have your phone number then you are mistaken. It will have already been uploaded by someone else.
The entire setup is geared towards leaving people with no privacy.
SpaceLifeForm • June 10, 2022 12:00 AM
@ Q
That is why the rewards programs always want your phone number and/or email.
The phone number and email unlock everything, destroying your privacy.
The business is getting a chunk of change to sell you out. You may get a tiny cut via a supposed discount.
No. And, No.
Those are the two answers to the two questions you will hear.
Do you have a rewards card?
Do you want to sign up?
Joe Twitter • June 10, 2022 1:39 AM
About a year ago, I opened a Twitter account, without providing a phone number.
Once I saw the accounting was working, I did not use the account at all; did not even log in.
About two weeks later, Twitter informed me my actions had violated their T&C and as such I was required to hand over a bunch more personally identifying information, including a phone number.
Phone numbers are gold to advertisers, because they are stable unique personal identifiers. Much much more valuable than email addresses.
I explained to Support I had not used the account, and so I had not in fact violated their T&C, and did not in fact keep a phone number, and they re-enabled the account, and I’ve had no problems since then.
I may be wrong, but I think this was fraud; that there is an automatic system which alleges T&C violation for the purpose of harvesting phone numbers and other information, for at least the purpose of targeting advertising.
Peter A. • June 10, 2022 4:13 AM
Another angle: FTC priced Twitter users’ harm ~$1 per count. This is the value of your privacy. Moreover, this $1, instead of being awarded to you as a measly compensation for Twitter’s fraud, has been stolen by the US government. This is the real effect of so-called “privacy laws” – an extra tax on YOU.
Ted • June 10, 2022 9:01 AM
It’s so hard to resist when you smell money, is it not? From the lawsuit:
… of the $3.4 billion in revenue that Twitter earned in 2019, $2.99 billion flowed from advertising.
Clive Robinson • June 10, 2022 10:42 AM
@ ALL,
Note two things from the ARS article,
1,
“The complaint further alleges that Twitter falsely claimed to comply with the European Union-US and Swiss-US Privacy Shield Frameworks, ‘which prohibit companies from processing user information in ways that are not compatible with the purposes authorized by the users.’“”
2,
“Twitter now offers additional two-factor options, including authentication apps and physical security keys.”
The first is a deliberate invalidation of the “data owners” ie you “consent”. Thus everyone should now say they require “binding consent” of such organisations. Not just at the time of consent but for “time ever after” such that if the company goes toes-up the receiver / adminstrator can not sell the data of as an “asset” and similar ruses used to get around “consent”.
The second many may think solves the issue of traceability / linkability of a user to them as an individual. As a general rule even “proofs” do not guarantee that. As a rule of thumb, every “infermation transfer” is a “unique communications” and as such is tracable in some way. All a “proof” generaly offers is one of very many ways has sort of been ruled out.
To see why consider what that “phone number” gave Twitter and other..
So I provide a proof that “No User name is transfered” and it would be true. However the transfer of the phone number which does happen is actually better than the users name. But with other databases that phone number becomes not just your name, but your home and work addresses, a list of those you communicate with or visit, the places you shop, you routes to and from work, the school you drop your kids off at, the hours you work, the bank you use, the Dr you visit, the dentist you visit and much more besides.
It’s a bit of a shock when you find this out. But… it works in reverse if I know say the school you drop you kids at and the place you work, usually these two pieces of information are effectively “unique to you”, the process has been called “jigsaw identification”.
What it tells you is any information that is communicated is either the primary key or part of a primary key to the rest of the information in one or more databases a simple search of which gives the rest of the information if it has escaped your control.
In effect the notion of “informed consent” is a great big lie.
Thus as @SpaceLifeForm has said above,
No. And, No.
Those are the two answers to the two questions you will hear.
Of “Can we have your XXX?” and when refused “Do you want our service because we need XXX?”
A local store I use, I pay only cash and I visit at random times and tend to buy what I need randomly. The check-out staff have been “programed” to ask “CARD or cash” and I always say “CASH only never personal data”. One of the checkout staff who has in the past indicated he thought “Maggie Thatcher” was wonderfull for what she did to unions, one day showed me his “store discount card” and said you can use any name you like and top it up with cash and get 2% off… I politely declined and said that 2% discount has to be covered by atleast five to ten times as much again hidden cost. He looked puzzeled and I said “Cash means Cashiers, Cards mean no Cashiers just lost jobs at the very least”, he still looked puzzeled and I pointed to the “self check outs” and said any cashiers jobs needed over there?
When I was next in there a lady cashier who had been sitting adjacent to him and had heared the conversation smiled at me and said it’s nice some people realise the cost of self check outs. She then told me they had lost around half the cashiers when the self checkouts had been put in but managment blaimed the pandemic…
Hopefully he will eventually sort out for himself what I told him. I some how suspect he will not work out that paying 2% more than with a discount card gives me way more real worth in the increased Privacy it buys me…
Ted • June 10, 2022 1:11 PM
@Clive, All
She then told me they had lost around half the cashiers when the self checkouts had been put in
One of my first jobs was as a cashier. I am absolutely fine with the self checkouts. 😉
However, your assertive stance in guarding your privacy is understandable. More from the FTC lawsuit:
Among other things, Twitter is a recidivist that engaged in unlawful conduct even after law enforcement action… Twitter has an incentive to resume its unlawful conduct, and it retains the means and ability to do so.
It looks like the FTC could impose a civil penalty up to $46,517 for each violation of a Commission Order. So we’ll see how serious this gets.
lurker • June 10, 2022 4:53 PM
@Ted, “I am absolutely fine with the self checkouts.”
Then you might be the target demographic. I’m not. I will not accept a poorly programmed machine giving me instructions which go against the most ergonomic way to pack my bag. At least a human cashier can see cash on the counter and know what it means. If I have to press a button “Cash”, then I’m working for the store. Did I get paid for that? Nope.
SpaceLifeForm • June 10, 2022 6:03 PM
@ Joe Twiiter
Thank you for doing the test. I knew what the results would be.
About two weeks later, Twitter informed me my actions had violated their T&C and as such I was required to hand over a bunch more personally identifying information, including a phone number.
The first problem was that you gave them an email addy.
Ted • June 10, 2022 8:16 PM
@lurker
Then you might be the target demographic.
I am the target demographic. I am willing to work for free to avoid an awkward conversation. I am the awkward one. It’s totally worth it.
Clive Robinson • June 10, 2022 8:27 PM
@ Ted, lurker,
One of my first jobs was as a cashier. I am absolutely fine with the self checkouts. 😉
Funny that was part of my first “weekend job” as well at a place called “Key Markets” that had stores all over South England.
The one in Brighton, gave me my first real world “Security Lesson”.
It was back in the 1970’s when CCTV was oh so expensive and quite difficult to get hold of unless you were a big store with major purchasing power.
Well one Friday morning very shortly after the CCTV had been installed in the store, two blokes wearing what looked like the uniform of the instalation company came in with a bunch of three part dot matrix computer print outs and went to “the office”. The manager was out but the assistant manager was a snotty type that sniffed at people to show displeasure, but who probably could not tie his shoe laces without help from mummy. Anyway the blokes said there had been some kind of cockup and the equipment was not supposed to have been installed yet, just the cabling and sockets, and they were there to take it to the correct store or some such.
Well they spent most of the day with the occasional help of the store security guard uninstalling the cameras, and monitors and recording equipment. Then got the assistant manager to sign the paperwork and went on their way. On the Monday morning the manager was “in the office” and apparently called “Head Office” to find out what the heck was going on… Surprise surprise nobody knew anything… Basically the two blokes had conned there way in and walked out with the lot, which back then was probably worth “ten years wages” for the average Joe. Not quite a bank heist but certainly very profitable for them…
But even “shelf stacking” could have it’s fun moments… We had to wear uniform which was basically a bit like the uniform tops nurses and some butchers wear that fasten with press studs rather than buttons. It was a hot summer and I was a not so pimply faced youth but still had raging hormones of a healthy teen, especially for one of my co-workers who was decidedly well endowed up top and had long blond hair, and she thought a lot of herself because she had “taken-in” her uniform top to better highlight her attributes…
Well she and I got dicked with the thankless task of stock rotation in the chest freezers and clear out any frozen bits that had come out of split bags. If you’ve never had to almost climb into a chest freezer to sweep out frozen peas or sweetcorn consider what a life experience you have missed…
Well as I said the summer was hot so being in the freezer section was helping me keep my cool despite having the raging hots for my co-worker working next to me. Who was leaning so far over into a freezer her toes were barely on the floor. Quite suddenly she gave a yelp and started to make odd noises. Turns out her uniform top had given way under the strain, and as she had decided to go shall we say under dressed due to the hot weather, her ample charms came into contact with the chiller pipes and her skin got frozen on hence the yelp for help. Any way as the galant gentleman I was I rushed to her aid. And together we peeled her off with minimal damage and got her uniform fastened without anyone else realy noticing… After that she was a lot more friendly towards me and I eventually got the nerve up to ask her out. To be different I invited her to go sailing for the day, which was a first for her, and even though it was only a 16ft Wayfarer dinghy[1] she loved it. It turned out to be a very fun summer.
[1] A couple of years later I and friend sailed along the English coast, across to France and up as far as Norway, in part to get away from “family”. And we had the very interesting experiance of sailing back across the South North Sea in what unexpectedly blew up into a bit of a storm… Luckily we had a radio and kept in regular contact with the Coastguard and I would update them with my running position estimates. Lets just say it was an experience to remember for good and bad. On getting back to the UK there is the formality of checking in with HM Customs and this we duly did. At first they thought we were pulling their leg. However it turns out the Coastguard had DF’d our radio signals and confirmed we were not mucking about (small wooden boats do not show up on radar). In fact a member of the coastguard told me that my running position estimates were “pretty good, and very supprising for such a small boat and young crew. Most other dayboat sailors we knew likewise did not believe us and said it was not possible even though Frank Dyke had done it from Scotland to Norway and written a book about it. You can see a photo of his wooden Wayfarer in,
https://en.m.wikipedia.org/wiki/Frank_Dye
I suspect if two teenagers did the same thing today there would be an out cry and demands for psychiatric reports and the like by hyperagitated Nancy types. What we saw as fun and a bit of an adventure, would these days be deemed so risky as to be lunacy… Which says rather more about “modern society” than it does about the actual risk. In the late 1800’s and early 1900’s fishermens wives in places like Fife, were still carrying their men through the sea to their not much bigger boats so they could stay dry and go “line fishing” in all sorts of weather as the fish migrated down the coast or returned to spawn. This is a picture of a typical smaller line fishing boat,
Showing the distinctive clinker build inherited from the Vikings, and the comparitively broad beam that gives good stability even in high seas. The same design was made in various sizes upto sixty feet, the hulls being almost the same as millennia old Viking trade boats (see “first class Zulus”). Even today the same basic hull design but with an inboard motor is used by “pot fishermen” who go after crabs and lobster.
SpaceLifeForm • June 11, 2022 12:55 AM
@ Ted, lurker, Clive
re: self checkout
If the machine can take cash, it can be much faster.
Recently, I had to endure an ID10T problem. The customer.
“Is this debit or credit?”
“Oh, I messed up, let me start over”
It seemed like forever to complete a $2.98 transaction. Literally, it was $2.98 and it was so much drama. She probably had that much change in her car under the seat.
I was at the point of just saying, just go, just get out of the way, I’ll buy your two beers.
Clive Robinson • June 11, 2022 5:38 AM
@ SpaceLifeForm,
I was at the point of just saying, just go, just get out of the way, I’ll buy your two beers.
Interesting “chat up line” did it work?
Mind you $2.98, for two beers, it was going to be a cheap date 😉
In my local “little town” there are three chain stores that have “self checkouts” and although two of them used to take “cash” none of them now do, few people use them and there is always long ques at the single cashier maned till. The exception being “lunch time” with the “sandwich and jolt cola IT crowd” paying with their mobile phones…
Oh as for “contactless cards” they are “inconvenient” at best. You wach people strugling with getting them in and out of purses and wallets because it appears all cards are contactless these days so Debit + Travel Card as a minimum and neither work in your wallet or purse. And some people have six or seven cards and you can see their “frustration” in their faces and hear it in their breathing, contactless is not convenient…
Oh and in the UK if you want to see pain in shop keepers eyes pull out an Amex[1]… I have a friend who’s policy it is to use one on those who “only do debit” cards and then after protracted negotiation offer cash as the alternative. They have what most think is an “impressive American accent” with “southern drawl” and you can have a lot of fun on just that. As he chearfully notes it’s a licence to be “Loud, Proud and Rightfully Indignatious”(LPRI)[2] and thus not only get away with it, but also licence to filibuster like a Southern Senator in those old black and white movies 😉
Despite the fact he makes even me feel small he’s actually quite shy and retiring by nature, and had to learn to “do assertive” for “death by viewfoil” presentations at conferences in the 90’s. He’s still got “a stack” in his office to show “those laptop jockies” what came before “Power Point”.
[1] Apparently Amex have the highest transaction fees by a long way, to pay for the better rewards.
[2] The fact that the acronym “LPRI” is also associated with the worst of Murray Rothbard and Ayn Rand via “Anarcho-capitalism” gives him in his own words “inspiration to draw on” accompanied by a wry smile… He also does a “Lincoln’s Address” as a party piece (first second and last sentences). The reason, he got “assigned” the part in college as part of the obligitory and enforced “liberal studies” and thus had to learn it, and the fact he stands out in a crowd like Ward Hill Lamon makes it all the more impressive.
Sumadelet • June 11, 2022 5:48 AM
@Clive Robinson
Re: Jigsaw identification
You are quite right to point out the mechanics and consequences of jigsaw identification, which happens to be the process that Craig Murray was jailed for ( h++ps://www.dailymail.co.uk/news/article-10258907/Former-British-ambassador-Uzbekistan-freed-four-months-prison.html ). Identifying anonymised witnesses in court cases get heavy sanctions: organisations doing the same routinely with population data is allowed.
If I take a short visit to More’s Utopia, should the use of jigsaw identification for any purpose be made illegal? In other words, all use of identification should be explicit and consensual?
Clive Robinson • June 11, 2022 7:04 AM
@ Sumadelet, ALL,
jigsaw identification, which happens to be the process that Craig Murray was jailed for
Yes and should not have been.
The problem with jigsaw identification “as a process” is that just about any “factual statment” can be used to start a search, that leads to identification of even people not talked about.
For instance, if I say “In the film the villain had a white cat, and smoked with a cigarette holder” Most would work out the hero was played by Scottish actor Sean Connery without me even mentioning anything about him or anything else about the film.
Which is why jigsaw identification should never be used as the basis for a crime, because it turns the fear of being prosecuted for saying the truth on a subject into a way of implementing censorship.
In Craig Murray’s case the judge was compleatly out of the tree… Because everything Graig said which was actually very little had already been said by other journalists in way more identifing depth both in print and online.
So she came up with some fatuous differentiator that it was OK for “proper journalists” to do that, but as she and she alone had decided Graig was not a journalist it was not OK for him to make refrence to it…
Put simply she had been told to deal with him as the Scottish First Minister had been caught out in her political dirty tricks campaign. So she had to find an innocent man guilty and jail him for refrencing the inconvenient truth.
The UK Civil Service, of which Graig was once a part of, used to have a touch stone of moral guidence on impartiality which was,
“Speak truth unto power”
So she did the biblical crucification on him, and in so doing brought the Scottish Justice system into total disrepute.
Sumadelet • June 11, 2022 10:37 AM
@Clive Robinson
A minor quibble:
The attributes of white (Persian) cat and cigarette holder apply to Cruella de Vil, from ‘The One Hundred and One Dalmatians’. These days, it would be politically incorrect to call her a villainess, so the attribute of ‘villain’ would apply.
But, I shall reiterate the question: would regulating (or banning) the commercial use of inference and jigsaw identification/deanonymisation be a worthwhile thing to do?
This isn’t a new problem. Harry Harrison wrote about it in his short story ‘Not Me, Not Amos Cabot!’ in 1965 (It can be found in the collection “Prime Number”). In this case, an inference was drawn about the character’s age and advertising was targetted at him without his consent. Technology has made the process more fine-grained and faster, but no less irritating.
Clive Robinson • June 11, 2022 11:54 AM
@ Sumadelet,
But, I shall reiterate the question: would regulating (or banning) the commercial use of inference and jigsaw identification/deanonymisation be a worthwhile thing to do?
Sorry I thought I had answered it, by pointing out it was impossible to do, because of the problem of,
“Any piece no matter how small will suffice”
Which is why it should never be used as the basis for an argument of criminal activity, because any thing could be argued to be sufficient for a conviction.
Alternatively as we have been seeing with Twitter and other Social Media platforms, it could be argued that because of “no matter how small” it is the equivalent of “anything and everything”. So from the Social Media platforms point of view,
“You might as well be hung for being a wolf if you will get hung for being a sheep…”
Because it’s the way you exist in the time it takes to get hung. And “If you go large enough” you can buy your way out over and over and over which is what Twitter has been directly accused of.
Their gamble is the fine and reputational damage will not significantly effect their income stream. So 150million fine for around 4-6billion in income… As they say “Go do the math”…
So unless the legislation removes the “collective decision” “Get out of jail free card” for the board and all those under them, and the share holders that fund them, then the punishment is not going to work.
The fine should not be a “windfall for the government” either because that just encorages them to play a long, just like a tick gets a free ride off of the host.
Even if you made the fine “one years income” it would still not work. Because all they would do in effect is have two companies, one that markets the advertising which gets all the profit, and one that runs the operation at a loss. Obviously it would not be quite as blatent as that but that’s what they would do.
We know this from the Film industry, look up the well known derogatory term “Hollywood accounting”. The worlds highest earning films was IIRC StarWars film franchise that have earnt billions, but strangely have always made a tax deductable loss…
If you want to have legislation that protects the citizen then you need “up against the wall” punishments for those incharge including the shareholders. But for that to be non avoidable you need to make significant changes in financial and company law. The argument that’s always used against this is it would stop inovation thus the economy thus taxes etc etc etc, which is code speak for,
“If you let us be crooked, we will let you have a taste, and some taste is better than no taste.”
Hence the legislators are fully invested in thos game and “we the citizens oay the price” no matter how or for whom we vote…
Does that answer the question?
Sumadelet • June 11, 2022 12:40 PM
@Clive Robinson
Thanks for your lengthy reply.
I agree that small amounts of information suffice; and with your characterisation of (commercial) approaches to fines. It seems that corporate personhood allows you to get away with shenanigans that natural persons couldn’t. It’s possible to put natural persons in gaol. Difficult to do to a ‘corporate person’.
However…
If you look at money laundering legislation, it comes with some interesting views on culpability. Employees get quite assiduous in following the rules as the legislation is clear on personal responsibility/liability/accountability for actions – the corporate veil is pierced. If processing of personally identifying information were treated in the same way, such that storing, processing and making inferences required explicit consent from the data owner, with a default ‘deny’, and employees were personally liable for ensuring this happened, I would wager that there would be fewer abuses. As Bruce has mentioned before, personal data should really be treated as toxic, and organisations incentivised to use as little as possible for as short a time as possible.
Charging companies a rental fee for use of the personal data asset might work. Once something turns into an operating expense, companies are quite good at reducing costs.
Sumadelet • June 11, 2022 1:26 PM
Previous reply held in moderation. No idea if it will escape. Not ignoring you, Clive.
Ted • June 11, 2022 2:49 PM
@SpaceLifeForm, Clive, lurker
I was at the point of just saying, just go, just get out of the way, I’ll buy your two beers…
Yeah, over time you learn which stores have screwy bottlenecks or inefficient point-of-sale systems and all that jazz.
A lot of stores just let me tap my card. They don’t even ask ‘debit or credit.’ Some even have apps that let you scan with your phone as you go.
Frustration at the POS is a very real thing.
As long as we’re in this thread. I am disappointed that I am not actually reached by the advertisers I’d like to hear from. I am looking for some plants I haven’t found in several local nurseries. I guess I should be grateful that I’m not seeing ads for them yet.
@Clive
To be different I invited her to go sailing for the day
My dad liked sailing. But where he lived before he was essentially landlocked. So it was mostly just sailing on lakes. That’s wonderful that you had a sail-mate. I honestly don’t know if it was challenging for him to get people as excited about it. He’s a lot closer to a coast now. Hopefully, your friend picked up some of the skills to be a help.
Clive Robinson • June 11, 2022 4:37 PM
@ Sumadelet,
Re : Previous reply held in moderation.
No idea if it will escape.
My experience says “probably not”.
You may have noticed the other day I split a reply down into 9 parts and posted bit by bit.
When I got to part 6 the system rejected it and so I split it into smalker parts 6a etc. 6C got me down to a single sentance that had no rude or otherwise objectional content so I did a synonym swap of three of the less common words and it went through OK.
If you keep each part down to six short sentances or a couple of paragraphs, they appear to get through.
Just lable each one as “Part X” or similar incase several people also post to the thread whilst you are.
Clive Robinson • June 11, 2022 6:25 PM
@ Ted, ALL,
Hopefully, your friend picked up some of the skills to be a help.
She got serious enough to join a yacht club and spend most of her weekends and some evenings “on the water”. And yes like me she advanced onto bigger boats and did serious off shore sailing including the Fastnet,
https://en.m.wikipedia.org/wiki/Fastnet_Race
Back then almost any boat could enter and small boats would take three days[1]. 79 changed all of that and oddly made it an international attraction for the “big boys”. These days your chance of getting in is about as close to no chance, with the more than three hundred places filled in four minutes. There are a lot of multi-million pound hulls taking part these days and the mono hull rule has been relaxed, and they do it in less than a day and a quater and less than a day has more recently happened.
[1] As a rough aproximation a mono hull “displacment hull” boat that rides rather than knife through waves has a non planing top “hull speed” that is related to the square root of the wetted water line length. So traditionally the longer the hull…
https://en.m.wikipedia.org/wiki/Hull_speed
This notion or “myth” is based on the observation that such a hull even in still water creates it’s own waves. As the boat goes faster the bow wave and stern wave constructively interfere and when the combined wave reaches the same length as the hull, it is effectivrly trapped as it’s “dropped in the slot”. As a “riding hull” tries to go faster the bows lift and the stern drops, so in effect it is trying to go up hill. Non riding hulls however cut through the wave they generate thus the water displacment is different and you do not get the same up hill effect. For a much more modern, explanation that is fairly easy to read,
https://www.yachtingmonthly.com/sailing-skills/busting-the-hull-speed-myth-82832
Oh and for those with a different interest, remember that projectiles moving faster than the speed of sound, are effectively in hydrodynamic territory. The articles discussion on “stern wave” drag applies to the “slugs” you use, hence the better performance with “boat tails”.
lurker • June 11, 2022 7:33 PM
So strong is this propensity of mankind to fall into mutual animosity that where no substantial occasion presents itself the most frivolous and fanciful distinctions have been sufficient to kindle their unfriendly passions and excite their most violent conflict.
[James Madison, The Federalist No.10, 1787]
Used as a description of Twitter by Prof. Jonathan Haidt.
https://www.theatlantic.com/magazine/archive/2022/05/social-media-democracy-trust-babel/629369/
Subscribe to comments on this entry
Leave a comment
← Smartphones and Civilians in Wartime Friday Squid Blogging: Squid Changes Color from Black to Transparent →
Sidebar photo of Bruce Schneier by Joe MacInnis.
Darron • June 9, 2022 9:38 AM
I suspect their profits from these targeted advertisements were much higher than $150 million.