{"id":14252,"date":"2019-02-15T21:06:00","date_gmt":"2019-02-15T21:06:00","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/even-years-later-twitter-doesnt-delete-your-direct-messages.html"},"modified":"2019-02-15T21:06:00","modified_gmt":"2019-02-15T21:06:00","slug":"even-years-later-twitter-doesnt-delete-your-direct-messages","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/even-years-later-twitter-doesnt-delete-your-direct-messages.html","title":{"rendered":"Even years later, Twitter doesn\u2019t delete your direct messages"},"content":{"rendered":"

When does \u201cdelete\u201d really mean delete? Not always, or even at all, if you\u2019re Twitter <\/a>.<\/p>\n

Twitter retains direct messages for years, including messages you and others have deleted, but also data sent to and from accounts that have been deactivated and suspended, according to security researcher Karan Saini.<\/p>\n

Saini found years-old messages in a file from an archive of his data obtained through the website from accounts that were no longer on Twitter. He also reported a similar bug, found a year earlier but not disclosed until now, that allowed him to use a since-deprecated API to retrieve direct messages even after a message was deleted from both the sender and the recipient \u2014 though, the bug wasn\u2019t able to retrieve messages from suspended accounts.<\/p>\n

Saini told TechCrunch that he had \u201cconcerns\u201d that the data was retained by Twitter for so long.<\/p>\n

Direct messages once let users \u201cunsend\u201d messages<\/a> from someone else\u2019s inbox, simply by deleting it from their own. Twitter changed this years ago, and now only allows a user to delete messages from their account. \u201cOthers in the conversation will still be able to see direct messages or conversations that you have deleted,\u201d Twitter says in a help page<\/a>. Twitter also says in its\u00a0privacy policy<\/a>\u00a0that anyone wanting to leave the service can have their account \u201cdeactivated and then deleted.\u201d After a 30-day grace period, the account disappears, along with its data.<\/p>\n

But, in our tests, we could recover direct messages from years ago \u2014 including old messages that had since been lost to suspended or deleted accounts. By downloading your account\u2019s data<\/a>, it\u2019s possible to download all of the data Twitter stores on you.<\/p>\n

\"\"<\/p>\n

A conversation, dated March 2016, with a suspended Twitter account was still retrievable today (Image: TechCrunch)<\/p>\n

Saini says this is a \u201cfunctional bug\u201d rather than a security flaw, but argued that the bug allows anyone a \u201cclear bypass\u201d of Twitter mechanisms to prevent accessed to suspended or deactivated accounts.<\/p>\n

But it\u2019s also a privacy matter, and a reminder that \u201cdelete\u201d doesn\u2019t mean delete \u2014 especially with your direct messages. That can open up users, particularly high-risk accounts like journalist and activists, to government data demands that call for data from years earlier.<\/p>\n

That\u2019s despite Twitter\u2019s claim<\/a> that once an account has been deactivated, there is \u201ca very brief period in which we may be able to access account information, including tweets,\u201d to law enforcement.<\/p>\n

A Twitter spokesperson said the company was \u201clooking into this further to ensure we have considered the entire scope of the issue.\u201d<\/p>\n

Retaining direct messages for years may put the company in a legal grey area ground amid Europe\u2019s new data protection laws, which allows users to demand that a company deletes their data.<\/p>\n

Neil Brown, a telecoms, tech and internet lawyer at U.K. law firm Decoded Legal<\/a>, said there\u2019s \u201cno formality at all\u201d to how a user can ask for their data to be deleted. Any request from a user to delete their data that\u2019s directly communicated to the company \u201cis a valid exercise\u201d of a user\u2019s rights, he said.<\/p>\n

Companies can be fined up to four percent of their annual turnover for violating GDPR rules.<\/p>\n

\u201cA delete button is perhaps a different matter, as it is not obvious that \u2018delete\u2019 means the same as \u2018exercise my right of erasure\u2019,\u201d said Brown. Given that there\u2019s no case law yet under the new General Data Protection Regulation regime, it will be up to the courts to decide, he said.<\/p>\n

When asked if Twitter thinks that consent to retain direct messages is withdrawn when a message or account is deleted,\u00a0Twitter\u2019s spokesperson had \u201cnothing further\u201d to add.<\/span><\/p>\n

\n

Twitter says bug may have exposed some direct messages to third-party developers<\/a><\/p>\n<\/blockquote>\n

\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/sk1-iMOozfU\/<\/p>","protected":false},"excerpt":{"rendered":"

When does \u201cdelete\u201d really mean delete? Not always, or even at all, if you\u2019re Twitter . Twitter retains direct messages for years, including messages you and others have deleted, but <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-14252","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t