“Protect my tweets” doesn't

I agree that it's an edge case; I disagree that it shouldn't inspire much worry. It's not intuitive that "only those you approve" means "people whose follower requests you have approved since you went protected, plus everyone who was following you before then, regardless of whether you follow them back". The three or four people I've mentioned this to in person were all surprised by that behavior, anyway.

(Full disclosure: I'm elsewhere.org.)

Because Twitter is all about broadcasting to people who follow you, I've always understood the "only those you approve" part to mean "those people following you that you haven't blocked".

The idea that you can get around being blocked by temporarily deactivating your account is interesting though and feels like it could be easily abused in this way.

The edge case is that A follows B, then A deactivates his account, then B switches her account to protected, then A deactivates account (within the 30 day window since deactivation). Now A is a bonafide follower of B (because he followed her before she switched to protected) and can thus view B's protected tweets.

I don't disagree that Twitter might as well patch up this corner case, but I think it's an extremely narrow corner case that shouldn't inspire much worry or outrage.

This seems like intended behavior -- the assumption on Twitter's part is that when you're setting your account to protected, you're also going to clean out the list of followers you have. I guess it'd be an improvement if Twitter added a notice, but I don't see what else they can do -- I doubt you'd want to tell all your followers to re-follow you.

The rule that's always served me well is, "Don't publish anything on the Internet that you wouldn't want on a billboard."

This includes sites that are supposed to be private, like online email providers, and especially social networks. I'm friendly with enough brilliant hackers to know better than that.