Twitter is secretly holding onto deleted direct messages

Twitter says it doesn't keep hold of private messages for more than 30 days after an account is deactivated

Anthony Cuthbertson
Monday 18 February 2019 17:05
Comments
Security researcher warns direct messages on Twitter may not be deleted completely
Security researcher warns direct messages on Twitter may not be deleted completely

Twitter seems to be secretly keeping hold of direct messages between users long after they were deleted, a security researcher has discovered.

Delhi-based researcher Karan Saini discovered long-ago deleted messages when he downloaded an archive of his data from Twitter, including messages sent to accounts that have since been deactivated.

"DMs are never 'deleted' – rather only witheld from appearing in the UI," Saini wrote on Twitter. "The archive geature lets you view these DMs, as well as any others with now suspended, or deactivated users."

In a follow-up tweet, he added: "I submitted the report for this to Twitter in January of 2018, and at the time, the team accepted the residual implications of the issue."

The issue raises serious privacy concerns for Twitter users, though Mr Saini noted that it is not a security flaw, rather a "functional bug".

Twitter's privacy policy states that anyone who deactivates their account will have their data deleted after a 30-day grace period.

"For up to 30 days after deactivation it is still possible to restore your Twitter account if it was accidentally or wrongfully deactivated," the policy states.

Twitter's terms state that log data – which includes information like IP address, browser type and operating system – is kept for a maximum of 18 months, though this does not encompass private data like direct messages.

A Twitter spokesperson was not immediately available for comment.

A statement provided to TechCrunch, who first reported the story, said the firm was "looking into this further to ensure we have considered the entire scope of the issue."

Register for free to continue reading

Registration is a free and easy way to support our truly independent journalism

By registering, you will also enjoy limited access to Premium articles, exclusive newsletters, commenting, and virtual events with our leading journalists

Please enter a valid email
Please enter a valid email
Must be at least 6 characters, include an upper and lower case character and a number
Must be at least 6 characters, include an upper and lower case character and a number
Must be at least 6 characters, include an upper and lower case character and a number
Please enter your first name
Special characters aren’t allowed
Please enter a name between 1 and 40 characters
Please enter your last name
Special characters aren’t allowed
Please enter a name between 1 and 40 characters
You must be over 18 years old to register
You must be over 18 years old to register
Opt-out-policy
You can opt-out at any time by signing in to your account to manage your preferences. Each email has a link to unsubscribe.

By clicking ‘Create my account’ you confirm that your data has been entered correctly and you have read and agree to our Terms of use, Cookie policy and Privacy notice.

This site is protected by reCAPTCHA and the Google Privacy policy and Terms of service apply.

Already have an account? sign in

By clicking ‘Register’ you confirm that your data has been entered correctly and you have read and agree to our Terms of use, Cookie policy and Privacy notice.

This site is protected by reCAPTCHA and the Google Privacy policy and Terms of service apply.

Register for free to continue reading

Registration is a free and easy way to support our truly independent journalism

By registering, you will also enjoy limited access to Premium articles, exclusive newsletters, commenting, and virtual events with our leading journalists

Already have an account? sign in

By clicking ‘Register’ you confirm that your data has been entered correctly and you have read and agree to our Terms of use, Cookie policy and Privacy notice.

This site is protected by reCAPTCHA and the Google Privacy policy and Terms of service apply.

Join our new commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies

Comments

Thank you for registering

Please refresh the page or navigate to another page on the site to be automatically logged inPlease refresh your browser to be logged in