2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.
3. So the scam is that some bad guy buys a previously verified account, changes the profile pic and display name to someone else famous, then uses it to phish.
#2 is colossally stupid, and is trivial to prevent (lots of dating sites require profile changes and pic changes to be reviewed before going live). Apparently this has been going on a long time so is baffling to me.
> However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.
I worked at Twitter and built the verification service. I recalled that this was the case back in 2012. You couldn't change your name or username if you were verified (or if you change one of those, you would lose the checkmark).
I believe around 2015/2016, a verified account I follow changed his name and avatar (but not username) to "Italian Elon Musk", and a Mario mustache and hat superimposed on Musk's then avatar. He made many posts along the lines of "I skippa tha taxes! Mamma mia!". Pretty obviously a joke, and after a while (I think a few days), he lost his tick, which I think was in a way his goal all along.
So if you're saying such changes for verified accounts have been disallowed since 2012, and if my dates are somewhat accurate, then I don't think that's right. But maybe you're just saying it used to be disallowed around 2012, not that it became disallowed then.
I can see why that requirement was dropped, because display name is sometime used as a profile line. e.g.:
- “Corporate, Inc. @ tradeShow Hall A”
- “DisplayName / A Trusted Brand”,
- “Individual (LIVE 09/21 21:00-)”,
etc.
Profile pics change for similar reasons. screenname(@username) is the only bitwise consistent visual element for a Twitter account so there will have to be either a magical audit algorithms to verify user perceived consistencies for changes, or simply a degraded experiences with impacts on engagements for verified users, to enforce that.
I'm an uncool dad but thought the check mark was like, this account really is the famous person the account claims to be, like Brad Pitt or Oprah. Now it's always someone I've never heard of.
Famous to who though and how famous? I recently clicked through to a profile of someone I had never heard of and they had 5m+ followers. This isn't a "look how out of touch I am with pop culture" humblebrag they were just from a different part of the world, famous in a language I don't speak.
And maybe not too similar but the mayor of my city only has a couple tens of thousands of followers but is definitely known by everyone who lives in it and yes has a blue check.
How famous is famous enough isn't a question with an obvious, or single answer.
My brother in law has a blue check. He writes comic blogs and wrote a book about them, so he does have a public persona. But he has less than 5000 followers and he is certainly not famous.
Could they simply disable the ability to change display names for verified users? It must match the government-issued ID / business documents / etc. that were used to verify in the first place. If you want to change it, send updated verification documents.
This takes away an avenue for self-expression (people will often change their display names based on trends, etc.) and might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...
> Could they simply disable the ability to change display names for verified users?
I don't know if I agree with this solution, but it is bizarre that there are plenty of blue checks where neither their twitter @id nor their display name have anything to do with their actual name. Who is the blue check verifying that they are?
I propose showing the verified identity (whether that's a stage name or whatever) on mouseover on the blue check icon. I'll take my consulting fee through paypal.
Sometimes people are famous under a username or pseudonym. Also Twitter generally verifies people at risk of being impersonated. It doesn't matter if you know who say CZ is but if thousands of people would pretend to be him and others will fall for it it helps to verify who the real one is.
Though clearly they should disable name changing post verification or something so the checkmark itself doesn't help to impersonate others.
And sometimes famous blue checks have an id that is unrelated to any name they have been known by, and a display name unrelated to any name they have been known by. I know this because I follow people like this. I know who they are verified to be, but that name is nowhere associated with their account.
Well, it kind of makes sense if you have e.g. a big youtube channel under and alias and people would know who you are based on that (e.g. Veritasium) but less people would know what your actual name is. However I don't use twitter so I have no idea how liberally this sort of thing is applied
> It must match the government-issued ID / business documents / etc. that were used to verify in the first place. If you want to change it, send updated verification documents.
That seems like a bad requirement, because I'd imagine a lot of these legitimately-verified accounts go by professional names (e.g. actors, authors with a pen name, etc.) not legal names.
A sane policy would be that there's a process for verified accounts to change their name, and that process is that some human at Twitter sees the account's current name and new name and rejects changes that aren't obviously still "the same person." A policy like this could prevent these kind of "pretend to be Vitalik or Elon or whoever" schemes without actually having to review the verification itself.
So you can still allow hashtags and emoji and so on being stuck onto names, still allow "spooky" Halloween names, but preserve some kind of value from the verified checkmark.
I don't know how many verified users there are but this doesn't seem like it would necessarily be onerous. Of course, it's still more onerous than just doing nothing about it is.
You can be flexible in the initial validation - it's reasonable to allow William Jefferson Clinton to go by Bill Clinton if he wants to.
And it's reasonable to allow name changes - it's not unusual for people to get married, or for companies to rebrand.
But why let people change names without repeating the validation process? It's not like people are getting married several times a year or anything like that.
I think business documentation in these cases is obvious choice. So you present good enough claim to that name or what ever and you get verification. This however means it is not personal account, but tied to that name or entity. Whoever owns it.
Facebook policy is to require a real name for every user. I'm struggling to see how that's relevant here.
If you want to tweet under an anonymous pseudonym -- great! We are talking about an optional verification feature for a subset of users who are at risk of impersonation. These people choose to participate in this program because they want their identity to be clear and legitimate.
People get verified because they're pretty well known, and people are rarely known by their legal names.
Celebrities are the obvious example, you probably know who Eminem or Lady Gaga are, but very few people know who Marshall Bruce Mathers III or Stefani Joanne Angelina Germanotta are. Others might also want to have their title in there names, for example presidents, professors, kings etc.
True, and there should be a way for people to get verified and use their professional / public persona names as Verified Identities.
They just don't get to change the name or image on the account without going through a manually verified update process. Pretty trivial, a singer goes on a new tour and wants to use a new headshot, checks out faster than reading this paragraph. A cracker hijacks the account and wants to change it to Vitalik Buterin, also pretty obvious to deny, as this is clearly a different identity inconsistent with the previous one.
That isn't always easy to verify though if you aren't familiar with the person, their public image, and their current events.
For example if Ed Sheeran changes their profile picture to an X, how do you know he means his Multiply album and not some terrible Lil Nas X impersonation. What about if a performer changes their stage name? Can we reliably expect Twitter research this change and know that its the same person?
>>Can we reliably expect Twitter research this change and know that its the same person?
Um, yes — it is their job. Most will be easy and some will be harder.
I understand that some small subset of people can have different public-facing roles. Perhaps the solution is to allow two accounts for each? After all, one can have one for your person and one for your company.
>This takes away an avenue for self-expression (people will often change their display names based on trends, etc.) and might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...
or you know, women changing their surnames after getting married ...
> might have edge cases (like transgender people whose preferred names may not match government ID cards) but it seems like it would be a step in the right direction...
Edge cases which can get people irreversibly dead. Doesn’t seem like the right direction to me.
Twitter users love changing their profile picture/name to support the current cause of the moment so much that it’s become a meme. Changing that would piss off their active posters.
No problem: add a second line with the verified name, or put the verified name in hover text if it differs from the display name. The verified name could still be a pseudonym, but it couldn't change without going through the verification process again.
Also, anyone willing to go through the verification process should get a blue check. Right now it's dependent on some Twitter insider liking the account holder (the insanely bullshit "Notable" requirement).
> or put the verified name in hover text if it differs from the display name
This isn't really a solution, because it's already "obvious" that it's the wrong user if you're looking closely. The UI shows "Vitalik.eth [verified checkmark] @scamusername" so you can see that @scamusername is not @vitalik. The problem is that you shouldn't need to look at the light text or hover to see that a verified user is who they say they are, the UI should make it completely clear.
This is obviously not true, unless I'm misunderstanding something. I'm not a twitter scientist, but I don't know what an "account name" is, unless it's the twitter handle. The twitter handles of blue checks are verifiably not required to have any relationship to a name that anyone knows them by, so are not a "verified name."
You'd still have edge cases where a change in verified name is needed (marriages, avoiding deadnaming, etc). A solution like this might narrow the problem space, but it doesn't solve the issues.
That would kill a lot of Twitter culture though (for better or worse). Changing a name for "spooky season", updating a profile pic to promote a new event, etc. It also would make it risky for a large company to change their logo (if Volvo loses verification for a few days it opens them up to a ton of scams).
Before I got off of Twitter years ago, friends of mine would make a background image with a blue checkmark and then add it to their profile so it looked like you were verified.
Easier than going through all the channels. Not sure if this still works, but a clever hack to get around (at the time) a very long process to get your identity verified.
>2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.
afaik twitter will remove your verification status if you do this maliciously. Like trying to impersonate a famous person and make it look like they're saying something stupid.
It's not a very good system either because it's called verification, but it's actually indicating popularity or notoriety. People hear "verified" and correlate that with trustworthiness when all that check mark is really indicating is "this person appears to be famous."
About once a week I get a mass message from a random twitter account with extremely clear spam (they even leave the group message after they send it!). They are often centered around crypto. I don't know how they are this bad because a Naive Bayesian Classifier could block this stuff.
> If changes to your account are misleading or substantially alter the persona present on your account
You will lose the badge if you try to do the 2nd. But currently it doesn't proactively apply preventative measures, which is definitely a problem. Twitter obviously doesn't have bandwidth to proactively prevent all those scams, but at least last reviewed profiles should be visible to users for verification.
1. There are a host of requirements needed to get the blue check: https://help.twitter.com/en/managing-your-account/about-twit...
2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.
3. So the scam is that some bad guy buys a previously verified account, changes the profile pic and display name to someone else famous, then uses it to phish.
#2 is colossally stupid, and is trivial to prevent (lots of dating sites require profile changes and pic changes to be reviewed before going live). Apparently this has been going on a long time so is baffling to me.