Get Even More Visitors To Your Blog, Upgrade To A Business Listing >>

Security Research on Twitter: Before and After Musk’s Takeover

This is going to be a bit less polished than my usual writing, because I’m hammering it out before a busy day at work.

My Twitter account was suspended last night, around the same time that a wave of prominent journalists being suspended for criticizing Elon Musk.

My Account Suspension was a bit less egregious than how journalists were treated, but it’s still remarkable because I have several comparable data points from before Musks’s takeover.

Why Did @SoatokDhole Get Suspended?

It’s important to emphasize, for background, that Elon Musk claims to be a “Free Speech” absolutist.

Yesterday, Musk banned the @ElonJet Twitter account, after explicitly promising not to. So much for free speech.

But his team took it a step further: They also blocked Twitter users from linking to the @ElonJet account on Mastodon.

They also banned the @joinmastodon account, shortly before adding the filter. Twitter’s going great, really!

Elon’s remaining Twitter staff apparently didn’t include any security experts, because it’s completely trivial to bypass their rule that prohibits posting a link to ElonJet on Mastodon:

  • Capitalize any letter in the URL
  • Append a query string (i.e. ?t=1)
Art: CMYKat

Naturally, I pointed this out. And when I woke up the next morning, my account had been suspended.

Security Research Before the Age of Ruin

Being suspended by Twitter isn’t exactly a remarkable feat. It surely isn’t, by itself, worthy of blogging about.

What is more interesting, however, is I have a history of criticizing Twitter’s security.

  1. My first real blog post here was about how, in April 2020, you could bypass Twitter’s client-side validation to make your Gender field hold a megabyte of data.

    This was publicly disclosed and widely exploited by trans people in protest of being misgendered by Twitter’s automation.

    No account suspension.
  2. I was a loud critic of the Birdwatch feature when it was first announced. I even tracked down the employees that worked on Birdwatch and sent them DMs to notify them of my critique.

    No account suspension.
  3. I’ve been a loud critic of Twitter features that use dark patterns to be user-hostile, such as Twitter Spaces. In fact, my article on how to remove Twitter Spaces was a top search result for relevant queries ever since I wrote it.

    No account suspension.

But criticizing their failed attempts to block people from posting a link to ElonJet? Banned.

Twitter’s Remaining Security Team

My interpretation of this shift in response to security researcher criticism is that Elon Musk is an absolute pissbaby and the remaining Twitter employees are sycophants and/or afraid of another Musk tantrum.

Takeaways

As predicted, Twitter has gone to shit. It’s only going to get worse from here.

You can find me on Mastodon at @[email protected].

I don’t intend to rejoin Twitter, even if my suspension is reversed.

Epilogue

Shortly after I published this blog post, Twitter’s UI updated to inform me that my account suspension is permanent.

Rest in piss, Muskrat.



This post first appeared on Dhole Moments - Software, Security, Cryptography, And The Furry Fandom, please read the originial post: here

Share the post

Security Research on Twitter: Before and After Musk’s Takeover

×

Subscribe to Dhole Moments - Software, Security, Cryptography, And The Furry Fandom

Get updates delivered right to your inbox!

Thank you for your subscription

×