Thread by @conspirator0

PSA: These "fun" apps from roundyear(dot)fun ("My Twitter Family" etc) have a downside: they gain near-total control of your account and (at the very least) use it to follow other accounts without your knowledge. #FunAllYearRoundUntilYourAccountGetsCompromised

cc: @ZellaQuixote

We had @DrunkAlexJones test some of the Round Year Fun apps. The list of permissions the apps request is extensive and encompasses pretty much every action one could possibly take with one's Twitter account. The apps produced the expected "My Twitter Crush" etc tweets.

Less expectedly, the Round Year Fun apps caused @DrunkAlexJones to follow six accounts:: @GeoRebekah, @ai3____, @zkerravala, @firefireband, @drago1171, and @MunaTaji. The apps also muted each of the accounts they followed.

How many accounts have been affected by Round Year Fun? We downloaded the latest 10 days' worth of tweets linking yearround(dot)fun, yielding 214830 tweets from 180402 accounts. The tweets were sent via 1091 distinct apps, most with names that are variations on "Round Year Fun".

The involuntary follow behavior of the Round Year Fun apps has resulted in massive infusions of followers since early April 2021 for its most frequent beneficiaries. Leading the pack is @GeoRebekah, with (at least) 20198 followers that have used Round Year Fun apps.

Here are follow order by create date plots for some accounts mass-followed by the Round Year Fun app. The plots show periods of massive growth where the majority of new followers are Round Year Fun users, and very few follows from Round Year Fun accounts outside those periods.

This analysis likely underestimates the number of accounts that have used the Round Year Fun apps and the number of follows that resulted, as the methods used would not detect accounts that were shadowbanned or had deleted their Round Year Fun tweets.

If you already used one or more of the Year Round Fun apps, you can revoke its access to your account and prevent it from taking further actions on your behalf. (Screenshots show the steps for revoking access using the Twitter website, phone apps are similar.)

Once more, with feeling: be careful what you click and be wary of giving third-party apps unnecessary access to your account.

Update: this thread apparently got a quick reaction.

*Round Year Fun

https://twitter.com/conspirator0/status/1383216598081622017