Hacker News new | ask | show | jobs
by tinbad 3065 days ago
It's so obvious that social platforms with business models based on number of ads/impressions like Twitter/FB are not incentivized enough to remove fake accounts, yet there seems to be very little public discussion or outrage about it. I agree with Mark Cuban here [1], they should do more to make sure each account has a real user behind it, even if it means less revenue. It's just the right thing to do.

[1] https://twitter.com/mcuban/status/957686987229618176

11 comments

> It's just the right thing to do.

That sounds like a sweeping statement with little forethought when you're talking about a platform that enabled protests in dictatorial regimes.

Step back here: Fake users, sold by the thousands to give credibility and a megaphone to whoever shells out money: bad. Identity verification: A solution with many consequences to be weighed before jumping on the bandwagon.

And dictatures aside, I have no desire to give Twitter my ID or passport.

I mean... we are the best of the best of the best, top of the class when it comes to technology and especially creative solutions enabled by technology. We have world-leading machine learning capabilities and hundreds of engineers working around the clock for money that, not that long ago, would have been completely unheard of. We have talent. We have time. We have money. We have passion. We have absolute shitloads of data on everyone, whether they use our platform or not.

We don't need a passport or state-issued ID to determine if someone is a real user. That's the laziest solution any tech company has ever come up with, and it's deliberately lazy.

Facebook and Twitter can already tell if you're a human or not, shit Google lets you just click a button to tell them you're a human and then they determine if they believe you or not. All based on info they already have.

We're the best software engineers the world has ever seen on the cusp of an AI revolution... we don't need your passport. We just don't want to find out the truth, so we make it so hard no one will do it.

When I last checked my google ad profile (and this was a while ago; now it contains a lot less info probably because I opted out of a bunch of stuff), it was full of errors. Google did get my gender right but they put me in the wrong age range and a bunch of interests were out of whack. Good thing this was for ads, rather than a heuristic to ban me.

Best of the best, top of the class is not infallible. It's good enough to sell, because even something as low as 80% accuracy is good enough for things like "Do you want to subscribe to weekly pop tv news", it's not good enough when at the other end you get your account banned.

Google has, on this very site, built up a horrible reputation of using automated processes and having too many users to give those affected by those processes some good recovery. What you're describing is a recipe to replicate that.

99% is not good enough. 99.99% accuracy gets you 0.01% false positives. That's crazy low, right? It's also 100k users when you have 1bn users. Those fancy AI processes are nowhere near that.

I have the same experience with ads all the time. Like, I get ads from Google to buy the Pixel XL 2 while I'm browsing the web on the Pixel XL 2 I recently bought from Google on the same account I'm currently signed in to Google with... Or Amazon will give me ads for books and things I recently purchased through Amazon.

I think a lot of their abilities are overstated.

It's not Google's fault. It's the people buying the ads who are too lazy or don't know how to do proper targeting.

I've met three people in my life who were employed primarily to place ads on the internet. All three were glorified secretarial drones who fell into the position because nobody else wanted to do it.

"Lazy"? It seems to me that the ad ecosystem is incredibly complicated (for example, not even Google understands how malvertising gets on Google's ad network).

Any person who knows how to effectively place Internet ads has such high-status skills that they don't have to actually do it.

> We have absolute shitloads of data on everyone, whether they use our platform or not.

We^W They may have shitloads of data, but I'm very skeptical we^W they can use this data in any meaningful way. At least, for now.

I don't know what's wrong but despite all that data giant AD companies are supposed to have, I never ever saw any relevant ads, even when I've specifically wanted to see one. Unless I've already bought something - then, sure thing, I'm spammed with more of the same (which is, again absolutely useless - I've already made a purchase).

> We don't need a passport or state-issued ID to determine if someone is a real user.

I don't think we are even capable to come to a consensus what does this mean - to be a "real user".

Am I? What about my alter ego, posting about something I don't feel like publicly associating with (like, porn)? What about a whistle-blowing throwaway account I may create if I learn something fishy? Or what about a "thoughts are my own but went through editorial" corporate representative persona account? And that's just the obvious cases.

You underestimate the difficulty and complexity of that problem.

I'm increasingly seeing this annoying trend of people hand waving about how a given problem can be solved with data/AI/ML/DL.

"I mean... we are the best of the best of the best, top of the class when it comes to technology and especially creative solutions enabled by technology. We have world-leading machine learning capabilities and hundreds of engineers working around the clock for money that, not that long ago, would have been completely unheard of. We have talent. We have time. We have money. We have passion. We have absolute shitloads of data on everyone, whether they use our platform or not."

- now just imagine the speech was pointed at the bad actors. and that's why this is not as easy as you make it sound.

>We're the best software engineers the world has ever seen

Maybe some of you are, but people like me read HN too ;-)

As with my estimate of real-world influencers on HN ("a handful"), I'd suggest there's probably the same amount of "world best software engineers" on HN (and no, I'm definitely not including myself in that.)
I know you're not saying that anonymous social networks are /strictly/ better than verified, but to maybe round this thought out explicitly - I think it's potentially naive to think that governments won't be able to wield social networks even more effectively than "freedom fighters". Whenever they catch up. Arab Spring was round 1, but I feel like round 2+ may have already played out in state actors' favors. Who knows.

Relatedly: if you participate or "observe" any online communities of marginalized people, you may have noticed there are starting to be earnest conversations of whether or not "free speech" is actually more easily wielded to abuse them, than they can use it to have a voice.

Just food for thought. A lot of built-in assumptions are being tested right now.

Stepping back from the whole arab spring thing: Let's think about what identity verification actually means for the user.

Let's assume for a second Twitter has a magic wand that, without consequences, automatically deletes fake users used for marketing purposes.

Now what does identity verification actually do for the remainder of the users? In what way does it benefit them? In what ways does it inconvenience them? In what ways does it put them at risk?

Should there be a process in place, that is required of the entire userbase, just to fix the fake user problem? A problem that most users aren't even sort of aware of (otherwise the NYT article wouldn't have been as successful as it was).

We do a lot of reactionary things as a society that follow this exact pattern: Put massive processes in place to remove tiny bits of risk. Governments do that and justify it all the time, cf. the "Terrorism" or "For the children" memes. You often read people's complaints here on the ridiculous security theater that the TSA is, how it doesn't solve anything and inconveniences everyone for something that happens to people less often than winning the lottery.

This, is that. The pattern is: You have a tiny problem, you fix it with something which impacts your entire userbase because you didn't stop to think whether there are more targeted solutions, or even whether it's worth it.

[Note: I argue lower down that AI and statistics aren't the correct fix for this either... gotta keep digging. Maybe the "correct fix" is a mix of identity verification and statistical analysis.]

> I think it's potentially naive to think that governments won't be able to wield social networks even more effectively than "freedom fighters".

That exact thing is happening. The Reply All podcast did an excellent piece on the dominant political party in Mexico using armies of people on Twitter - not bots, but people - to drown out news they didn't like, and eventually, to harass people. Show, with full transcript: https://gimletmedia.com/episode/112-the-prophet/

Enabled protests in dictatorial regimes, sure. But let’s not overstate social media’s positive impact: nearly a decade after the Arab Spring, few governments outside of Tunisia look markedly different.

The ability of state actors to use social media to spread propaganda should also be considered in our tally of social media impact. The jury is still out on whether they are a net good.

This isn't an argument about whether social media is a net positive. This is about people, and whether Twitter protects its users at risk, or builds a system which just begs for government to request their real names.
It is an argument about whether lack of verification on these platforms is worth preserving. That is not proved convincingly by the instances of protests they allow, since this same practice also allows propaganda.
Would it be possible to do a 1-time verification, and then throw away the data? Twitter needs to see a driver's license or passport once, not keep a scan of it.
That seems fraught with peril also. Does Twitter do any check of the data? If not, you've probably just dramatically expanded the market for fake IDs. If so, can governments monitor such verification attempts and associate them with new accounts? If you're living under a hostile regime would you trust Twitter with your ID regardless of assertions of confidentiality?

And there are many people who lack a driver's license and passport. Are they disenfranchised?

> not keep a scan of it

What prevents me from using the same id in bot accounts then? Verification implies they have to keep some form of personal identification.

That's a different problem though. What if you could do identification that didn't involve giving someone your passport?

Authentication adds a potential cost-of-reputation to social media content that you post, which in turn may raise the value of the content. If there were a safe, secure way to do it, then why not?

Oh great, so now we’d be tied down by chains of conformity. How’s that for a surprising change of meaning to the phrase “Global Village”!
Could you explain how you be tied down by chains of conformity?
Speaking as an ex-Facebook growth employee, fake accounts actually hurt growth and are actively sought out and removed by a dedicated team. Think about it--if a user receives a bunch of fake friend requests, it's a bad experience. This is one of the (many) reasons MySpace died--because of the onslaught of porn-promoting accounts that they never cleaned up until it was too late.
Facebook certainly has been more diligent about stomping out fake accounts than most other services, with Twitter being social media's problem child.

A telling anecdote: A security researcher friend of mine found a somewhat small botnet of twitter accounts (~7000). Reported it to twitter, a few months passed and he noticed twitter hadn't done anything. So he turned it over to a journalist who eventually poked someone at twitter and... poof all 7000+ accounts were gone 6 hours later.

WTF? What can account for that? I'm not cynical enough to believe that they _encourage_ botnets.

Maybe simply no dedicated people or team for the problem?

I set up a fake Facebook profile a long time ago as a prank, added everyone at my college as friends, and people I know still say they get notifications about his birthday. And people still reach out to wish him a happy birthday.

I have no idea what credentials I used to create it so I can't delete it, but it still exists (unlike the person it's pretending to be).

I think the signature of those kinds of fake accounts are different than most of the malicious accounts though.

You creating a fake college account and forgetting about it probably passes as human enough, there's no concerted effort or agenda to that account besides existing and adding friends at your college.

I think what makes bots and fake accounts generally detectable is consistently pushing certain messages in ways that exceed normal human behavior, as well as showing patterns across many fake accounts.

It's hard to see a pattern in one fake account, but easy to spot it across many.

Twitter is full of those porn promoting accounts. Typically this is an account with some female name and a profile pic of a person in a state of undress following lots of popular accounts.

Twitter doesn't even take them down if you complain about them. Very annoying.

Not just porn. My account with ~150 followers was, out of the blue and within a week, followed by a dozen different "startups". Every single one of them follows tens of thousands of people in the hopes of getting followed back. It's pathetic.
I'm not sure that's quite the same thing. That seems to be an example, at least somewhat, of using the platform as intended.

If your profile is public, and they decide to follow it, in part, to make you aware of their existence, perhaps that's a feature not a bug, given that the main use for the thing is to connect with accounts and follow them and discover content.

I see random accounts occasionally following me, and it's clear that they're just casting a very wide follow net to see who will follow back, presumably to get their readership up. To me, that's spam, no question about it. Even if it's targeted. (Targeted spam is still spam.)

I want people to follow me because they're interested in what I post, not because they're looking for me to follow them. Perhaps I'm asking too much of the platform, but... it is what it is.

I have had a Twitter account for I think close to a decade that I never use. I’ve never tweeted or followed anyone. Last time I logged in which was probably over 2 years ago, I had dozens of followers, all following nothing!
Yeah that’s probably accounts managed by some random shaddy tool that follows tons of people in the hope of getting follow-back then massively unfollow everyone.
> Think about it--if a user receives a bunch of fake friend requests, it's a bad experience.

Except that Facebook knows who is real and who fake. Just like my mail provider knows who sends spam and who doesn't.

Facebook can display ads to fake users and still make the campaigner pay for the impression, or make a group pay for reaching more users, fakes included.

Facebook can easily filter requests from fake profiles, so no, fake users do not necessary worsen the experience for real ones.

"Facebook can easily filter requests from fake profiles" "Except that Facebook knows who is real and who fake."

You say that so definitively. Have you worked on a product with millions of new users a week? It's an extremely hard, constantly shifting problem.

"Facebook can display ads to fake users and still make the campaigner pay for the impression"

Facebook's entire business relies on user and advertise trust. Why would they sacrifice that for some short term growth that would inevitably kill the business by eroding trust?

While I don't pretend to have been party to internal FB conversations when certain decisions were made, as an advertiser, FB has definitely done some things to significantly erode that trust over the years.

For starters, encouraging advertisers to spend money to build up an audience with the assumption they could continue reaching that audience much like email, only to throttle organic reach to zero was pretty bad.

There have been other things such as being extremely...generous...with the definitions of how some ad metrics are defined and what defaults are presented. Even as an experienced advertiser who knows to look for those things, the lengths to which some of it it is buried is astounding to the point of it being hard to trust that it wasn't intentional. And the recent lawsuits around such things shows I'm not alone in that feeling.

> You say that so definitively. Have you worked on a product with millions of new users a week? It's an extremely hard, constantly shifting problem.

Facebook has hundreds of engineers and enough data to do match patterns against. Facebook can largely identify who's who.

> Facebook's entire business relies on user and advertise trust. Why would they sacrifice that for some short term growth that would inevitably kill the business by eroding trust?

Yes, the infamous "they trust me, dumb fucks"?

"Facebook has hundreds of engineers and enough data to do match patterns against. Facebook can largely identify who's who." I know, I used to work there. I was asking you. Pattern matching isn't black-and-white, as you alluded to in your previous comment.

"Yes, the infamous 'they trust me, dumb fucks'?" You didn't do or say stupid things when you were 19? You don't believe in giving second chances, let alone to a teenager?

Weirdly enough and probably unrelated, I had at least 4 fake friend request from “attractive” women in the last 2 weeks on FB. Mostly these accounts would disappear within hours or minutes. Never had that in x years of being on FB.
It's worse than not being incentivized to remove fake accounts - they are _actively_ incentivized to be selective about which fake accounts they "detect".

How many of David Brock's bots have been removed from Twitter?

But why does it matter to a general user if there are real or fake users behind twitter accounts? It makes no difference to me whether I have fake followers or not, as I'm not going to be forced to see anything they're posting (or not posting). I can just ignore them and follow who I want.

It seems like it only matters from an investment stance.

I care because I get a notification when someone follows me, and I want my notifications to be a source of data with a high SN ratio. I want to notice that a someone has followed me so I can click through and decide if I want to follow back. If it's a bot account, I've just wasted my time, because I never want to follow bots.
The only practical way to do that is to take a credit card and run a test transaction against it. If Twitter had tried that it would have died in the nest. People wouldn't take the risk for an unknown benefit. A large portion of their current tweeters still wouldn't, or couldn't provide such proof.
> The only practical way to do that is to take a credit card and run a test transaction against it.

Doesn't really work everywhere in the world.

Ah, to solve the social media bot problem, we must first simply uplift the world to a unified economic system.
They just need to actually open up verification to everyone not just saying they are but in reality keeping the same requirements that are so subjective.
Is a brand considered a "real name and real person"?
Yes, at least according to the Supreme Court of The United States.
In most legislations, a brand is considered a "legal person". (which is hilarious when you register your company as forms kind of treat the company as if it were a person)
I don't see why not. A brand is owned by a company. That company has a registered name and real people working the social media accounts.
Why? Same applies.
There is no ReactJS company. There is a company behind ReactJS but that's irrelevant since there's also a company behind those millions of fake users.

What about my pet open source projects, shall I shut down their account because they don't have a company backing them?

I think you're arguing a point that no one upthread made. The proposal was to make sure that a real person was behind the account, in good faith - not necessarily that person's personal account. So your accounts and the ones you linked to upthread are fine. The "good faith" part means that there can't be a hard-and-fast rule for which Twitter accounts are okay. Human judgement will be required to sort out good-faith users (including brands or open source projects) from bad-faith users (paying people to run accounts that just inflate other accounts' numbers).
"It is difficult to get a man to understand something, when his salary depends on his not understanding it."

-Upton Sinclair

Bots will only increase as AI improves, and throwaways are important. They should definitely be honest about their numbers, though.
False dichotomy. Spam and impersonation is bad. Anonymity and pseudonymity and tweet interfaces to bots that provide useful services are all hugely beneficial.

Twitter’s main strength is its low barrier to entry, for end users and developers alike.

> .. FB are not incentivized enough to remove fake accounts

What makes you think Facebook isn't prioritizing this? I'm not questioning whether you're right about this, just curious about what made you draw this conclusion.

"Hey, $MAJOR_CORP, advertise with us, you'll reach millions of your target market! Just pay $X."

"So how many of them are real and how many of them are fake accounts?"

"We work very hard to make sure Facebook is free of fake accounts."

"That's not the answer to my question.".

Its interesting you'd say that, considering that facebook publishes an estimate of the percentage of fake accounts in its quarterly public filing.

Disclaimer - I work for facebook.

Take this hearsay as you like.

Someone I am intimate with left Facebook in the last month, in anger at the way senior management up to and including MZ first dismissed the severity of the problem of their platform being used to push propaganda during the election cycle.

And then stonewalled and foot dragged efforts to correct this. By the account I got the only incentive for action has been unflattering attention at the national press level.

This from someone with a personal relationship with Z.

Make of it what you will. The poison is real.

> Someone I am intimate with left Facebook in the last month, in anger at the way senior management up to and including MZ first dismissed the severity of the problem of their platform being used to push propaganda during the election cycle.

Intelligent and reasonable people can disagree - strongly as to the extent of how much of a problem this is, whether or not it is a problem, or whether the cure is worse then the disease.

This also has little to do with fake user accounts.

Honestly, once you become that rich and powerful, I can imagine it's pretty difficult to not live inside a bubble. They probably don't understand how serious some problems are because they're not normal users. Also, it's probably hard to not let it go to your head and think that you always know what's best for the common rabble.
Propaganda is separate from fake users though.

I haven't seen a claim that fake users played a large role in spreading propaganda or fake news. As far as I understand it the issue lies in what people were sharing and what Facebook identifies as trending news.

That's a pretty different issue from Twitters fake accounts.

I've seen stuff debunked by Snopes ECT so I link to Snopes to show my friend that what they shared was fake news, only to see him share the same link next week. He claimed he did not read the article but it agreed with his political views so it must be true.

I've seen fake Twitter tweets as well that have bad spelling and other stuff in them that it is obviously a fake tweet made by some website fake tweet generators out there. Then shared on Facebook as an uploaded image. If they don't link to the original tweet on Twitter consider it a fake tweet.

Your criterion for determining a fake tweet doesn't work if someone regularly tweets things and then deletes them. The combination of this behavior and abundant fake tweets allows people who like and who loathe a particular person on Twitter to build up opposing views of what is real.
Yes it is hard to determine fake tweets if someone keeps deleting their tweets.
there seems to be a twitter discussion happening with regards to authoritative/oppressive governments subpoenaing twitter to get a user's identity if that were to happen for voicing an opinion that isn't in line with the regime's. how do you solve this while giving every account an identity?