What a mess. Twitter just unveiled its new Tip Jar feature—which lets anyone using the English app (at least, at launch) send money to a handful of Twitter users whose work they’d like. support it—than major privacy flaws were found in what would otherwise be an innocent way to throw people a few bucks.
While I’d normally take this time to complain about how annoyingly slow the rollout of features is, I’m actually thankful that Twitter isn’t letting everyone make their own tipped jars right now There are a number of issues with the feature associated with using PayPal to fund these tips—one of the many payment options available—and they’re worth knowing about. forward you accidentally, say, send your home address to a random person on the Internet.
This potentially catastrophic risk to your personal privacy was first discovered by security researcher Rachel Tobac, who shared her findings in a tweet:
While Twitter plans to take additional steps to let users know that their personal data may be shared as part of the tipping process, this whole issue is really more of PayPal’s problem to solve . For this, I have not heard a glance.
G/O Media may receive a commission
2 for $60
Crocs: 2 for $60
Open in style
Included in this sale are several very trendy marbling and tie dye varieties, from black and white to sherbet pastels. Text your mom: she’ll want a pair.
As more people started digging into PayPal-based advice, some other privacy features emerged. For example, if you set up a tip jar and link it to PayPal, but you don’t have one PayPal nickname, anyone who initiates a tip will be able to see the email address you have associated with PayPal. (They don’t even have to complete the transaction.) If that’s your personal email address that you’d rather not have in the wild, well, tough luck. Better get that nickname as soon as possible.
We’re not done yet. If you take a closer look at Rachel’s tweet above, you’ll notice that PayPal is charging a fee as part of the tip transaction:
This should come as no surprise to anyone who has used PayPal to send money, well, ever. But there’s a curious interplay between fees and privacy that you should also be aware of if you plan to tip someone for their work on Twitter.
My advice? Do not use PayPal at all for these transactions. If you must advise someone on Twitter — a practice I wholeheartedly encourage if you find value in their work or insight — fund it entirely through another service. You can currently choose from Bandcamp, Cash App, Patreon, and Venmo, which should be more than enough for the occasional donation. Keep PayPal when information like your address actually matters (eBay). Do not give randomly Twitter users access to that information, not at all costs.
