If you decide you’re playing enough to use Twitter’s new feature to send money to strangers on the Internet, do your best not to accidentally send them your home address.
To explain, you may have heard something about Tip Jar, which the company released on Thursday, foreshadowing it as a way “For people to send and receive advice.” The new feature, which is available through the Android and iOS mobile app, allows users to send money to other accounts using various third parties. The job is very easy: By clicking on the dollar bill icon next to a person’s username, you will be presented with a list of options on how to donate: Venmo, Cash App, Bandcamp, Patreon, PayPal, etc. Selecting a payment option redirects you to the platform of the selected third party to allow the transaction. You want to hurry to do this as a way to … uh, reward good tweets? Yes, the meaning of the whole business is not entirely clear, but do people really need a reason to throw more money on the internet? Apparently Twitter is trying to become a bigger platform for creators and this will help.
However, Twit-Tips is currently undergoing a trial run, with a number of creators, journalists and non-profit organizations acting as guinea pigs to whom Twitter users can send money, although the claim that the feature will soon be available a wider version is currently only available to people who use Twitter in English.
As is usually the case with new things, consumers were quick to point out some things that weren’t entirely hoarse. Rachel Tobacco, a security specialist, was playing with the app when she noticed what initially seemed like a clear security risk. Tobacco found this if you used PayPal specifically to tip someone, you’ll also send him a very intimate detail: your home address. This does not seem to be a problem for any of the other payment applications set up via Tip Jar.
In a tweet shared by Tobac, an image of a PayPal donation receipt clearly shows the sender’s address.
“That’s exactly what I was interested in testing when Twitter announced Tip Jar. PayPal needs to become crystal clear about what data is given to recipients of money and stop sharing that data, and Twitter needs to educate users who are not aware of what recipients of information they receive when they use PayPal, ”Tobac posted on Twitter.
Kaiwon Bakepur, product manager on Twitter, was quick to respond to comments: “It’s a good catch, thank you. we cannot control the disclosure of the address by Paypal, but we will add a warning to people who give advice through Paypal to be aware of this. “
However, it turns out that this is not a strange mistake, it’s just a feature of how payments work with PayPal. In particular, there are two different modes through which payments can be made and received on PayPal accounts – one of which requires the disclosure of your address, as it is fixed to “Goods and Services”, ie. delivery. So, we can assume Tobac uses this mode to send a tip. This is certainly something that customers should be aware of, said Tom Hunter, senior manager of global communications with PayPal, in an email. Hunter said.
When using PayPal to send and receive money, there are two options that the customer can choose before processing the payment for how to send that money. “Goods and Services” is used to purchase or pay for an item or service from someone and will automatically share the customer’s address with the recipient for the delivery of those goods and services. Customers can switch within the payment flow to select “Friends and Family” who does not share the address with the recipient. This is the standard functionality of the PayPal application and we will work closely with Twitter to ensure user awareness.
While this is not an obvious security risk, it is certainly good for consumers to know. Sending your address on the Internet, whether intentionally or unintentionally, is usually hated, but seems pretty easy to avoid if you have a good understanding of PayPal’s functionality. Of course, if you’re willing to send someone you don’t really know a lot of money to, maybe you’re willing to tell them where you live? I do not know.
When reached by email, a Twitter spokesman reiterated that they have no control over how PayPal works or whether users know how to use third-party accounts, but said they would try to tell users:
Tip Jar tea is performed in the selected payment services application or website and as a result relies on the functionality of the third party service. When you tip Tip Jar, people are notified that they go to a separate app or website to send their tip, and that the tip on this third-party platform is subject to the terms of the platform. We update the notification in the application and Help Center article to make it clearer that other platforms, according to their terms, can share information about people sending advice to each other.
Properly marked. In the end, it’s probably a good thing that this whole little episode happened, because it highlights some potential privacy issues when it comes to the new feature – something Twitter probably tested in the first place. The slow spread allows companies to discover such things. Twitter it is said in his message that he “is always looking for feedback and ways to improve updates like Tip Jar – let us know what you think.” There seem to be some.