\n
![](\"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2019\/10\/Twitter-Safety-796x418.jpg\")
<\/p>\n [ad_1]
\n<\/p>\n
Twitter recently disclosed an \u201cincident\u201d in how the service handles phone numbers. The announcement declared that it had shut down \u201ca large network of fake accounts\u201d responsible for uploading lists of phone numbers and then using Twitter\u2019s own API to match them to individual usernames.<\/p>\n
According to the Electronic Frontier Foundation (EFF), this is precisely the type of activity used to create reverse-lookup tools: the types of services that match specific users, or their accounts, with an otherwise random phone number.<\/p>\n
Twitter, Facebook, and other social networks all offer the option to upload your contact list into the application to connect with other users. The APIs used to support these types of uploads often contain limitations to keep bad actors from exploiting the tools. But there\u2019s almost always a workaround. In Twitter\u2019s case one of the API limitations in place rejects anyone who tries to upload a list of sequential phone numbers \u2014 a clear indication that it\u2019s not a user uploading their contacts.<\/p>\n
But the security researchers who tipped Twitter off to the problem found a comically simple workaround: randomize the uploaded information to avoid sequential strings of numbers. This allowed them to match phone numbers to usernames for more than 17 million Twitter users, including celebrities and public officials.<\/p>\n
So far the problem only seems to affect Twitter accounts who have a phone number associated with their account, and have \u201cphone number discoverability\u201d enabled in their settings. If you\u2019re unsure, you can check the EFF\u2019s step-by-step guide to checking your settings here.<\/p>\n