How to Fix Twitter: Prism, Crypto, dids and Verified Tweets

A free, at cost proposal to Jack Dorsey and Twitter would fix the impersonation and hijacking problem behind bitcoin giveaway scams targeting accounts like Donald Trump, Elon Musk, Bill Gates and Barack Obama.

Any fix has to follow four principles: do not change Twitter much, keep it simple, build on solid foundations, and do not touch the business model.

Even after Twitter's biggest security hack ever, the fix does not require a huge spend or a redesigned interface, just a small addition to the existing UI.

Public key cryptography, a 1970s era foundation of internet security, pairs a public key with a private key that only its owner controls.

A signature works by signing a message with a private key to produce a signed message that anyone can verify with the matching public key, giving it non repudiation.

The DID standard from the W3C, backed by the Decentralized Identity Foundation whose members include Microsoft, IBM, Hyperledger, Accenture, RSA and IOG, gives a way to handle online identity with public and private keys.

A DID has two parts: a short DID identifier and a DID document, structured like an HTML file, that can embed the user's public key.

The verified tweet concept hashes a tweet and signs it with the user's private key, adding just a small checkmark difference in the UI while staying simple and built on solid cryptographic foundations.

Registering a verified tweet means creating or importing a DID in the account settings and sending it to a whitelisted ID verifier, such as Verisign or a government agency, to confirm the person behind it.

The resulting DID carries two signatures, one from the whitelisted verifying authority and one from Twitter, neither of which the user can forge even though the user still controls the underlying private key.

Anchoring the signed DID on the Cardano blockchain adds timestamping, public auditability and immutability, since the record stays available and unchangeable once it is there.

Atala PRISM already has these capabilities built in for both the verifier and Twitter, with demos and case studies available at atalaprism.io.

In the account flow, users create or import a DID and pay a small fee to the verifier to get verified, making identity verification an economically self-sufficient business while Twitter takes a cut.

Because Twitter never holds the private key inside the DID document, a full platform hack could still only send unverified tweets, never verified ones, from a compromised account.

PRISM also supports zero knowledge threshold proofs, like proving someone is over 18 without revealing their birthdate, and handles credential revocation and key rotation if a user loses their device.

The signing key can live in a phone's secure hardware enclave, such as Samsung Knox, unlocked with a fingerprint, so users only ever need to look for a blue checkmark.

The whole system could ship in three to six months, done at cost, with the offer open to even audit the financial statements to prove it.

The same DID keys let two users open a secure private channel for shielded messages, and enable stronger login through a challenge response that adds a third authentication factor alongside a password and hardware token.

Recalls Elon Musk's joke about what the SEC stands for as a case for curated tweets: multi-sig tweets require a message to be signed by the account owner, then by a pre-approved group, before it can post.

For institutions like Apple or the White House, requiring m of n signatures on official tweets stops a single compromised person from controlling the communication.

Twitter's misuse can start wars and crash markets, and impersonation scams have stolen millions of dollars from the least technical, most vulnerable users, so this has to stop.

A whole constellation of verification entities can plug into PRISM at no cost to Twitter since users pay their own verification fees, and for extra resilience the DID record can be anchored redundantly across multiple blockchains like Bitcoin and Ethereum.

These identity foundations could later make it easier to turn Twitter into a cryptocurrency payment platform.

Recommends Mailvelope, a decade old Chrome extension for PGP encrypted email that he personally uses, as an easy way to learn the key management ideas behind verified tweets.

The end user experience stays simple: a green or blue checkmark next to verified content, phones and computers handling key management through biometrics, and revocation tracked through the blockchain's history of keys.

Closes with a direct challenge: Twitter should adopt this, and the rest of the crypto industry should propose similar fixes and make this one of the era's great success stories.