Associating an account with a number is a way to emphasize that it was created with more effort than the simplest macro, and could be used to filter which tweets are featured most prominently or pass through the various levels of quality filters. Twitter also allows users to have the same phone number associated with up to ten different accounts, while developers can flag automated accounts to let people know there’s no human behind each post. Verified “blue check” accounts are already required to have a verified phone number or email address attached. When then-CEO Jack Dorsey talked about plans to enable verification for everyone, he mentioned having people verify facts about themselves, which could be similar to how services like Airbnb and Tinder use phone numbers as part of their account verification processes. However, encouraging users to link phone numbers to their accounts and display status means securing that data becomes an issue. On August 5, Twitter announced the details of an incident that allowed an attacker to discover 5.4 million account names associated with specific phone numbers and email addresses. By the company’s account, the privacy flaw was introduced in a June 2021 update, wasn’t reported to Twitter until January, and Twitter didn’t know the information had been stolen until July, when media reports surfaced that someone was trying to sell the database . The 2020 hack that allowed attackers to tweet from the accounts of Jack Dorsey and Joe Biden about Bitcoin occurred after the attackers socially engineered how to use Twitter’s internal tools. Another Bloomberg report noted that some contractors had used Twitter’s tools to spy on celebrity accounts, and earlier this month, a former employee was convicted of espionage after he used his position to “access their email addresses, phone numbers and dates of birth of users who have criticized the government of Saudi Arabia.” In May, Twitter agreed to a $150 million settlement for improperly using phone numbers and email addresses collected for two-factor authentication in ad targeting, showing just how leaky the data can be. With midterm elections around the corner, there is pressure to ensure that information posted on social media comes from real people, or at least someone actually in the country they claim to be. The phone number tag could play a role in judging an account’s credibility, but it’s unclear if or when Twitter could make it widely available.
