So you trust me.. The trust in security..
I engage alot of people on twitter and over the years, I've gotten a decent number of followers particularly in the tech ecosystem here on twitter... I find different and interesting ways to engage my audience and create a personalised touch inside or outside of twitter, these include group zoom calls, phone calls, and even personalised SMS.. In most cases, I tell people to DM me their phone number so I can call them, more often than not, I get alot of DMs that I'm unable to call everyone.
Jan 1st, 2025. I came up with an idea to not only say "Happy new year" to my audience on twitter, but to also send the greetings to them via SMS.. Think about it, in the world of Whatsapp, Telegram, Instagram, when last did anyone send you a direct SMS.. I also wanted to make this a surprise.
I had a couple of options :
1. Tell people I want to send them a Happy new year SMS ( It'll ruin the surprise )
2. Tell people to DM me their number that I have a surprise for them ( Now I have to start writing the numbers out one by one, that's alot of work)
3. Create a form and ask people to fill in their number and expect a Happy new year SMS.
4.. You get the gists, the options goes on and on..
But here's what I did. I told people to fill a form and not ask why - My plan? The mystery will make them not expect the text., and yeah it worked, a couple of people filled the form and I sent them a happy new year... But there's a twist..
And here's the twist - Security Consciousness...
There was a form that expected people to just put in their phone number, without context.. While people agreed because of the trust they had in me, it also opens the door to something else... Here's a simple way for me to explain this part.
You know how people use one password across different websites?? It's not just because we're lazy, it's also because we tend to migrate patterns (It's the reason why alot of websites look similar).. When we're used to something, we just go along with it.. The connection here is, When people get used to someone they know telling them "Put your number here, don't ask me why", one day someone they don't know can tell them something similar and they'll just carry over that behaviour...
I'm an advocate of telling people not to drop personal information online anyhow or fill such in comment section.. Here's a simple test for you : Go to anybody's account and search the work "bank", if they've tweeted their account number, you'll see it, If you copy that account number, you can get their name and even guess the country they're living in. You can start a chain from that..
The justification I had in my head : If I had tweeted "DM me your phone number, I have a surprise for you this new year" I'd have still gotten a couple of DMs with phone number, and this time I'll still be able to attach the phone number to a handle. I felt just collecting the phone number without any other info makes it a wind data (It's valid but lacks context for actual usage - I came up with this word)... However this still does not fix the behavioural ideology my request created.. People could pass this over unto other platform and create multiple chains...
What if I was hacked??? This is also an interesting perspective, the case here is that, if I was hacked, it doesn't matter if people sent their numbers to me via DM or in a form, the hacker would still have access to the number..
What if the form's data was hacked ??? The hacker would have access to valid phone numbers but probably not their info, I mean due to alot of Neobanks, some people's phone number is their account number so that's also tricky,, so yes, the hacker would have access to people's account number... The case here is, hackers can also just generate random phone number and verify each one to check the validity, so alot of work for not so much result if you ask me...
I'll continue to engage my audience in personalised way, but I'll make sure to give better context, and even in cases of surprise, I'll talk about the process and how the data will be used..
I sincerely apologise for feeding into the behavioural migration pattern, and I'll definitely do better next time and take alot of factors into account in future communications..
What happened to the data after I sent the Happy new year SMS?? I deleted it..
Thanks to the people who shared several other perspective with me...