Comment by 10000truths

Right, a lot of that trust is implicit and we don't think about it every day. But for threat modeling, it helps to spell out the chain of trust explicitly:

  * You trust the browser/OS

  * Browser trusts the root cert store (either embedded in the browser installation or managed by the OS)

  * Root cert authenticates the twitter.com connection

  * Twitter validates the legitimacy of the account (anti-spam/anti-impersonation/verified user etc.)

  * You trust that the person who made the post on the Twitter account is the person you want to communicate with

If any of these can be violated, it's an opportunity for attack, be it via a technical exploit, social engineering, political favors, whatever. Ultimately it's up to the user to determine what to trust and what level of risk to accept.