FYI, all, if you did that "Twitter family" meme: revoke permissions for the app to access your account, then check who you're following and remove the follows they added to your account and immediately muted so you wouldn't notice they had

It's in Settings and Privacy -> Account -> Apps and Settings

Sorry, the correct name of the subpanel is "Apps and Sessions"

And, to speak a bit about authorized apps and the like: it's not automatically bad to authorize an app on your Twitter account, or even to leave the app authorized after you're done with the immediate task you authorized it for. (Deleted to repost bc of a typo changing meaning.)

The app authorization proves is actually better than the old way people used to make these little account toys back on MySpace and LiveJournal, which was "you have to give the account toy app your actual password instead of a revocable authorization". Which plenty of people did.

(I have plenty of horror stories about having to clean up after an account toy that asked for passwords turning out to be a sleeper for spam, malware, or just plain account hijacking. SO MANY HORROR STORIES.)

The important part of authorizing apps is to carefully read the set of permissions they ask for. A well written, nonmalicious, legitimate third party Twitter tool will request the minimum permissions it needs to work, and explain why it needs each permission.

For instance, a shared-blocklist tool will obviously ask for permission to read and edit your blocklist, since that's why it exists, but most of them will also ask to read your following list. Why? Because most won't block an account you already follow.

If you're authorizing a third party tool to access your Twitter account, read the permissions it wants carefully, and compare those permissions to what it says it's going to do. In this case, the app that produces the "Twitter family" meme asked for permission to post:

sure, okay, the purpose of the toy is to post a meme tweet. Asks for permission to read your follows: okay, maybe it uses that for making its list. Asks for permission to follow people: uh, now it's getting weird and overbroad.

Then it goes off the wall. Why does a meme toy want to create and manage lists with my account? Why does it want to be able to mute, block, *and report* other accounts? Why, for the love of little green apples, is it asking for permission to *update my profile and settings*?

The answer is because it's not a meme toy app. It's an app belonging to an evil marketer who sells followers to people who want to up their follower count on Twitter, and because they aren't fake followers, the evil marketer can charge much more for them.

And in fact, the people more likely to use meme toys about their account are more likely to be heavy Twitter users, so a Trojan horse meme toy is *incredibly* profitable for people to make and get permissions to follow. They look to clients like legit accounts because they are!

Twitter will eventually block this particular app from accessing the account authorization system -- as it happens, it's owned by someone who's long since been banned entirely, they just concealed it better this time. It shouldn't be more than a day or two, probably.

But this is a great example of why it's incredibly important to carefully read the permissions a third party Twitter app is asking for, and think for a few seconds about whether there's anything on the list that just sounds suspicious.

If you can't immediately identify why a particular permission would be necessary for the alleged purpose of the app, and the app developer doesn't explain it up front, the app is either a) made by someone who doesn't care about security or b) a front for something scuzzy.

In both cases, you want to either use the app and immediately deauthorize it after the specific task you're using it for is complete, or (much safer!) refuse the authorization and go find a less suspicious app that does the same thing.

Also, a belated addition: the one permission you should be most cautious of granting, and never agree to unless there's a *damn* good reason and that reason is disclosed in advance and clearly explained, is the ability to update your account settings.

Belated other note: someone let me know Twitter auth permissions are less finely grained than I thought I remembered them being, so sometimes an author does have to ask for overbroad permissions because Twitter bundles them together.

That having been said, a legit app will still explain that, and explain why certain permissions will appear in the list, and you should still be cautious of any app that doesn't!