C’mon Twitter! Quit Leaving Direct Messages Vulnerable To Spam

by Dave Larson on January 21, 2012

Spam is probably Twitter’s biggest problem. 

But as it is now, instead of making it easy to identify the more spammy type of Twitter accounts, Twitter is actually hiding that information from you!

Hey, Twitter: Quit Protecting Spammers!

Wouldn’t you want to know before following someone if they spammed everyone that follows them with an advertising message?

But currently, if someone sends a DM spam to everyone that follows them, you have no way of knowing! And so you follow someone who seems nice…and you get spammed. Again.

If you follow someone, they can direct message (DM) you. If Twitter made the additional requirement that you must also have sent them a tweet at least once before they can DM you, DM spam would be cut way, way back.

This would mean spammers would be forced to send their spams by tweet instead of DM, and tweets can be seen publicly. So this is not only a spam prevention method, it’s a spam identification method. Spammers couldn’t hide their spam messages any more!

Alternatively, Twitter could simply add a “let them DM me” feature instead of making it automatic. But this would be confusing, and take a lot of effort if you had to do it for each person.

Dealing Five Large Setbacks To Twitter Spammers

This one simple change would have HUGE effects:

  1. It would be much harder to hijack accounts. Right now, 99% of hijackings start as DMs that send you to a page that tries to trick you into entering your password (usually by looking like a Twitter login page). When someone you follow is hijacked, their accounts starts sending out these phishing DMs, trying to hijack accounts. In this scenario,  if they can’t DM you, they can’t hijack your account.
  2. Spammers would be stopped cold from the tactic of following people, to get follow backs in order to send DM spam.
  3. Spammers would get far fewer followers, because their spam messages would be seen publicly, instead of hidden as DMs. They could no longer pretend to be “just folks” publicly while sending tons of spam to everyone that follows them.
    This would send a big signal to Twitter’s spam-identification algorithm—spammers get fewer followers and are more visible due to needing to spam more publicly—so Twitter could suspend them faster.
  4. One of spammers biggest sources of income would be hit hard, since the auto-follow, auto-DM software would no longer work. Currently, spammers create other spammers by selling this software, telling you to use it to auto-follow people, and then spamming the people that follow you back by DM.
  5. Block automated spam DMs. Spammers create tons of Twitter accounts automatically, have them tweet automatically, and send their spam automatically by DM. This means one person can create thousands of spam accounts, but none of it works if they can’t send spam! While stopping auto-DMs doesn’t stop spam, for all the reasons listed above it makes spamming much, much harder to automate and profit from.

To the ignorant and greedy, Twitter has long looked like a spam paradise, because they can hide the spam they send so no one knows they are a spammer. Twitter needs to put a stop to this.

Make DMs Useful Again

Many long-time Twitter users publicly state that they don’t read their DMs, because they are so inundated with spam. @ChrisBrogan even said he would quit Twitter if Twitter didn’t let him unfollow everyone so he could get rid of all the DM spam.

And this wouldn’t change the way DMs are already useful: you connect with someone you follow via tweets, then you switch to DMs to continue your conversation. This would still work automatically, since you follow them and have sent them a tweet.

Spam is killing Twitter, DMs are badly broken, and Twitter needs to to act soon to fix things.

Make Twitter Twice As Useful

By putting spammers on the run by making DMs protected and useful again, Twitter could them use DMs to open up collaboration by allowing them to be longer than 140 characters.  This isn’t as radical as it sounds. Tweets would still be limited to 140 characters.

Why Even Twitter Won’t Use Twitter

If you make a support request to Twitter, they reply via email. Twitter is a communication system that not even Twitter wants to use when they have to collaborate with users! There’s a word for that: broken.

For the rest of use, to collaborate usually means exchanging private emails, and ends up splitting the collaboration: some of the information is on Twitter, some of it is in emails. By letting DMs run a little longer, people could keep their whole conversation on Twitter, and avoid the awkward security issue of whether to give out your email to someone.

A Wide Variety of Benefits

I regularly get 3-5 DMs in a row from people trying simply to explain a question they have. And the people that don’t often don’t include enough information for me to help them, and I have to ask for more information.

This would also make it easier to “attach” files. Now, you have to link to whatever files you want share, but the links use up the room needed for communication. By letting DMs be a little longer, you could include several links and still have room.

Test show that people rarely need more than 500 characters for emails (that is, if you limit them to 500, as the ShortMail service does, most people still get things done in one email). That is about the length of three-and-a-half tweets, and in my experience, would eliminate 99% of the multiple DMs we receive as @TweetSmarter when helping people.

It would also allow you to really share key content, instead of forcing people off to a link to search through an article. You could excerpt key points from a blog post, for example, without forcing people to go to a link and dig through it to find the data you want to share with them.

You could compare things in a single DM, such as a brief summary of three apps with a link to each. You could provide tech support, by having enough room to write down detailed instructions.

Twitter could charge more for this service if they wanted, or could simply roll it out initially to their advertising partners as an additional benefit.

Summary

What do you think?

Is it time for Twitter to stop letting spammers hide their spam and send it to anyone that follows them? Would Twitter be more useful if your DM inbox had less spam, and was easier to use for collaboration? Leave a comment and let us know!

{ 12 comments… read them below or add one }

Jason T February 2, 2012 at 4:07 PM

I got rid of my Twitter account for the same reasons, SPAM, I moved all my info to Google+, Twitter is getting old anyways.

Reply

Dave Larson February 3, 2012 at 3:08 PM

Most people simply ignore their direct message stream when it becomes a problem, i.e. no one is FORCING you to look at it. In other words, if you don’t look at it, you don’t see the spam.

Twitter is certainly much older than Google plus. What will you switch to when it gets old and there is more spam there?

Reply

John Nagle January 31, 2012 at 1:21 AM

Would a Twitter client that checked the legitimacy of links in incoming tweets and DMs solve this problem? We could repurpose our anti-web-spam technology to do that. Let me know, please.

Reply

Dave Larson February 2, 2012 at 1:12 PM

Twitter itself does check links, as do most browsers, but the problem is that “illegitimate” links can quickly be replaced with new ones that haven’t been caught yet, and some sites that seem legitimate to automated detection systems can still cause users problems, such as phishing sites that cause no harm unless you enter your password on them.

Also, spam is not necessarily “illegitimate.” Much of what what people consider to be annoying is not necessarily easily classifiable. For example, if I see that a user’s tweets are 90% “Thanks for following me” it’s clear to me that they aren’t really engaging with people, and are probably automated or semi-automated. But a single “Thanks…” tweet on its own doesn’t make it clear that it’s coming from a bot. (In fact, money-making spam bots are smarter than humans in this sense, and appear much more like real people.)

So it’s hard to know much from a single tweet sometimes.

Reply

John Werry January 30, 2012 at 11:43 AM

Great post and one that personally impacted me today. I followed someone this morning and immediately received a message back with a link. I unfollowed immediately.

It spurs me to think about dealing with this issue in my own product. I could see building a feature that provides a “smart follow” action. It would look like this:

(perform within tool that implements smart follow)
1. User hits the follow button on a user
2. The software watches for return DMs for up to x seconds or x minutes; looks for presence of links or not. (Time-delay and link-watching is configurable)
3. Tool notifies you with a popup that your follow was just “auto-DM’ed” and shows you the message. (could also notify you through email vs. popup)
4. Tool allows you to DM back a message of your choice, “sorry, I don’t like receiving DM spam” or whatever you chose to write. Or nothing.
5. Additionally, the tool has a checkbox to unfollow immediately after posting the return DM in #4 above.

Reply

Dave Larson February 2, 2012 at 1:19 PM

I agree that would be a useful feature in some cases. Of course, those tools can just delay sending the automated DM, but that’s not a common standard feature at this time, to the best of my knowledge.

In particular, you are addressing a very useful benefit: spam prediction/prevention. Although your feature would only truly deliver a small aspect of that benefit, when developing or promoting a product, it’s useful to be able to say your tool addresses large benefits :-)

Reply

david holden (@etominusipi) January 26, 2012 at 11:45 PM

good post. important admin matters. spam is annoying tho i only usually get 1 or 2 a day, and blocking them seems to be a chore that socially responsible tweeters have to take on board, like picking up litter in the street. anything that makes spamming more difficult would be welcome, and somethings along the lines you suggest should be discussed.

having your account hijacked via the DM route is much more serious. it crosses a definite line towards malevolent behaviour, so if it were feasible to do so it should be made a criminal offence.

i think most people would favour your idea of a 500 character DM. i don’t use DMs a lot, but when i do it is often either to explain a problem, or respond to someone else’s, and the 140 char limit is nearly always a nuisance (& if in a hurry it is quite easy to accidentally try to send the second part to yourself, which wastes time and causes irritation).

i can live with the 140 char tweets, tho since it is an arbitrary cut-off i don’t, like some more conservative souls, regard it as a dogma of religion. not being able to do long tweets with deck.ly any more irked me, especially the sneaky way it was done, with the interface still appearing to allow the longer tweet, then failing to deliver it, but with just an error message, rather than an informative explanation. at that point i fell out of love with twitter, and i hope one day something will come along more suited to my own particular communicative needs, which are mainly literary, philosophical and political, rather than commercial.

Wikipedia is the only major website which has appropriate ethics for the new age. all the rest are corporate whores whose commercial interests to some extent conflict with the interests of their users.

slightly off topic, but it is a little odd that twitter seems so faceless.

sorry to ramble. appreciate the work you do.

all the best,

david

Reply

Dave Larson January 29, 2012 at 7:06 PM

Yeah, once deck.ly got well established, the onus seemed to have been on Twitter to make it’s demise more obvious to people. Not a great move on their part.

Interesting points about Wikipedia and Twitter. Twitter seems to be taking some very clear stances about what they think Twitter’s use case is, and it isn’t very social. They see it as information sharing and data mining. I do hope they find room in their mission to make the social features of Twitter work a little better though.

Thanks for chiming in.

Reply

nicky January 23, 2012 at 5:31 AM

Hi Dave

Interesting post. I dislike spam DMs too but I would say there’s a big difference between the bots and the people.

If you Follow someone back on Twitter you’re subscribing and so you’re opening up that avenue to receive DMs. I’ve personally received some welcome DMs – even the ones with links in them, because smart marketers give you something useful – free video/report or whatever, rather than just trying to sell you something straight off. I think that if people spent more time on looking into someone’s Tweet history and their website (if they provide a link) the DMs promoting their stuff wouldn’t come as such a surprise.

The Bots on the other hand are a major pain in the posterior. I get a lot of @mention spam with dodgy links in them and it’s fine if you realise that they’re spam, but I’ve known a lot of people who are new to Twitter who just don’t seem able to spot them, even with some guidance.

I like the idea of DMs being longer – that’s a great idea :)

Nicky

Reply

Dave Larson January 29, 2012 at 7:02 PM

Great points, Nicky. The longer DM thing—or something—seems essential to make them really useful as intended for private chat.

Regarding permissions, said another way, the core issue I’m getting at is that automated DMs offer a payoff to hijackers, spammers and misguided users. By making the payoff hard to achieve without real interaction first, a lot of problems are ameliorated.

Dividing folks into bots vs real people is an excellent distinction…until the bots that are are great appearing real begin to dominate. It’s no problem for a bot to appear real, and many of them do, but it’s not really necessary for them to, so few do.

So if everyone did check for “bots” vs “real people” before following, the better bots would dominate, and the other bots would have to follow suit. Spam/hijacking is a war of escalation, and so I’d like to see their payoff made harder to reach, not simply something that requires better bots, because they will appear in large numbers if forced to :-(

Reply

Ashley January 21, 2012 at 9:42 PM

“This would mean spammers would be forced to send their spams by tweet instead of DM, and tweets can be seen publicly.”

Tweets being public does not deter spammers. Spam bots can also spam via mention Tweets. And they do. A LOT.

@cartooninperson

Reply

Dave Larson January 22, 2012 at 2:33 PM

It’s a combination of things that deters them. Yes, they currently spam publicly. But preventing them from spamming via DMs and forcing them to do almost all of it publicly:
• Makes it much harder to hijack accounts, producing less hijacked spam
• Gets them less followers, making it less effective to spam on Twitter, leading to less overall spam
• Breaks some of their automated tools, resulting in fewer spam accounts, and less spam overall
• Helps Twitter’s spam-identification algorithm so Twitter can suspend them faster, resulting in less spam
• Hurts one of their sources of income: selling automated tool to send DM spam, resulting in less spam
• etc.

Reply

Leave a Comment

{ 1 trackback }

Previous post:

Next post: