Wow, good catch. I wonder if anyone from Twitter reads HN. Seems like this is something they'd want to fix.
So to replicate this bug, I'm guessing you just have to get around 100 people to RT a tweet from a protected account. I imagine that isn't a common use case. But it's still a privacy issue.
2 comments
[ 5.7 ms ] story [ 12.2 ms ] threadb. search for [vevo]. http://twitter.com/#search?q=vevo
c. second Top Tweet as of 16:10 PST is a protected tweet: http://twitter.com/gagadaily/status/15721434645
This demonstrates a case where random user can view the content of a Protected Tweet.
In this case it seems the Retweet is making something private into something public.
So to replicate this bug, I'm guessing you just have to get around 100 people to RT a tweet from a protected account. I imagine that isn't a common use case. But it's still a privacy issue.