How DNS Could Help Stop the Rise of Fake Twitter Accounts

August 9th, 2024 Written By Aman Singh, Edited by ChatGPT

Image Created by Aman Singh using Canva 09-12-2024

08-05-2022 Articly by Mark E. Jeftovic

How DNS Could Help Stop the Rise of Fake Twitter Accounts

Tackling the Fake Twitter Profile Problem with DNS

In a recent article I wrote for Bitcoin Magazine, I explored how DNS underscore scoping could help us streamline Lightning addresses. The idea is to use this technique to create a sort of universal specification that would work across any blockchain resource—be it a wallet, smart contract, or other.

The basic concept is pretty straightforward: You’d reference the resource you want using underscore scoping within DNS labels in TXT records.

I know, DNS can be a bit confusing at times. Especially when it comes to things like underscores—are they even allowed in DNS? The short answer: is yes, but only if you understand the differences between hostnames, domains, and labels. For anyone familiar with SRV records, this is nothing new. We see underscores all the time in protocol definitions (_tcp vs. _udp) or services like _xmpp. These underscores aren't limited to SRV records—they can be used freely as alphanumeric labels in DNS TXT records.

Now, toward the end of my Bitcoin Magazine piece, something struck me—what if we could use a similar DNS convention to tackle a problem that has plagued the Bitcoin and crypto community for years: fake Twitter handles.

The Fake Twitter Handle Scam

You know the drill. Scammers set up fake Twitter profiles that look just like the real ones, except the handle is slightly different. It’s like a digital version of a typo attack on domain names. They’ll copy the bio, profile pictures, backgrounds—everything. Then they start sending private messages to followers of the real account or people interacting with it, trying to lure them into some trading scam.

Since the scammers often replicate every detail of the original account, including the URL in the profile, this gives us a chance to authenticate the real handle via DNS, using the domain in the URL field. Imagine if it became a standard practice to add TXT records to a domain’s DNS zone. This would allow Web3 clients, social media tools, and maybe even Twitter itself to verify handles quickly.

Putting It to the Test

To prove this concept, we built a Chrome extension that can tell the difference between a real Twitter handle (one with the DNS setup) and a fake one. For testing, we set up both my real and fake handles. The proof-of-concept code is available on our GitHub if you want to check it out. By the way, if you’re into mail management, we also released a Postfix policy manager earlier this year—worth a look.

Can Scammers Use Fake Domains in the URL Field?

Yes, they can. We face a similar problem in the domain and hosting world where scammers register look-alike domains and even get TLS certificates issued for them. It’s an arms race that we deal with on our Domainsure platform, especially for high-stakes domains like crypto exchanges.

But here's the thing: running these scams at scale without paying a cent is easy. Once scammers have to spend money on fake domains, the game changes. The economics of the scam shift, and the cost-to-benefit ratio starts to favor the good guys.

What I’m proposing isn’t some proprietary magic. It's just a best practice that leverages the backbone of the internet—DNS. If adopted, this could help reduce one of the more persistent and harmful problems on Twitter and social media in general.

_______________________________________________________________________________

Sources:

• Rise of Twitter Fake accounts, discussed in Mark E. Jeftovic article, "Solving the “Fake Twitter Profile” Problem using DNS" August 5, 2022.