0

Twitter allows you to download your entire profile history as an archive.

To do so, you need to be logged in to Twitter, and then re-enter your Twitter password, and then enter a one-time token sent to your phone or email, and then request the archive be made available.

All that makes sense to me - the archive contains personally sensitive data, and you don't want someone sitting at an unattended computer or phone to be able to access it. It also makes sense to me that it may take an hour or two for a background job to assemble all the data into a zip for download.

But the message displayed is:

We received your request. To protect your account, it can take 24 hours or longer for your data to be ready.

Is that Twitter just hiding behind security as an excuse for the slowness of their system, or is there is it justifiable on security grounds to include a large lag before sharing sensitive data?

1 Answer 1

2

Time delays certainly can add security, since attackers usually have a narrow window in which to launch an attack before it is noticed (and the target can narrow this window by notifying the potential victim that the request was initiated and letting them cancel it). However, this is usually done in situations where strong authentication isn't available. "A one-time token sent to your phone or email" is approximately the weakest form of multi-step authentication in use - it's not even necessarily multi-factor since usually it can be broken using the same kind of credential as the password (memorized secret) - but it's generally considered adequate security for most things.

With that said, "To protect your account" doesn't necessarily mean "to prevent this specific action from being taken maliciously". In some contexts, it would be considered risky to store more data than is needed in "hot" storage (connected to running servers), as then any kind of breach of either a user account or the server could expose rarely-needed but sensitive data (or to put it differently, automatic archiving could reduce the "blast radius" of a security breach). This is probably not the case at Twitter, though; AFAIK they keep all tweets and DMs available in real time through the server.

... Actually, does the archive contain deleted tweets/messages (your own, not other peoples', obviously)? If so, that would make sense of the delay; it's extremely reasonable of Twitter to not keep deleted content in hot storage any longer than needed, and restoring it from a backup would obviously take time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .