Delete Your Twitter DMs Now, Warns Security Expert

Twitter users should delete their direct messages (DMs) now to lower the risk of confidential data leaking, according to a security expert.

Twitter has fired thousands of engineers and seen the departure of several senior executives overseeing security and safety issues. That, coupled with Elon Musk’s desire to rip out huge chunks of the Twitter codebase, is leaving Twitter users exposed to a “worrying” degree of risk, according to Graham Cluley, an independent security analyst who has previously worked for Sophos and other security firms.

Cluley says Twitter accidentally deactivating SMS-based two-factor authentication (2FA) earlier this week is a sign of the chaos within the company. “If Twitter is careless enough to break how 2FA works for some of its users a few days ago, what mistake might they make next?” Cluley writes on his blog.

“If Twitter’s security experts have either been fired, have quit, or – presumably – are wondering where they should go next, then just how safe is my data on Twitter?”

Twitter’s defenses down?

Cluley fears that Twitter no longer has the expertise on hand to deal with a serious attack. “It may be a remote possibility that Twitter will have a monumental security screw-up or suffer a hack that it simply doesn’t have the expertise to protect against, but it is a possibility,” he writes. “And it’s a possibility that seems more probable today than before Elon Musk bought the company.”

“There’s not anything I can do to make a chaotic Twitter safer. But I can reduce the potential risk to me, by deleting my DMs.”

DMs are much more likely to contain sensitive information that users wouldn’t want made public. Although there’s no way to delete all of your DMs in one go, other than deleting your account altogether, individual conversations can be deleted one at a time, by clicking the three dots menu next to each conversation in the Twitter web interface.

Cluley concedes that even erasing the DMs doesn’t prevent Twitter from keeping a copy of them somewhere on its servers, but says he’d “rather delete them one-by-one than one day find that they are in the hands of a hacker or a disgruntled Twitter employee who goes rogue”.

One thing that might improve DM security in the long term is end-to-end encryption. There are rumors that Elon Musk plans to add encrypted DMs to the new $8-per-month Twitter Blue subscription package.