Mashable - The Social Media Guide - Latest Comments in Is It Stupid to Trust Twitter Apps With Your Password?

Re: Is It Stupid to Trust Twitter Apps With Your Password?

missburrows — Mon, 05 Jan 2009 14:17:15 -0000

Hi Stuart,

Yes, Twitcrush.com tweets for the users.

I'm sure we can all agree that we want our users to feel safe, secure and happy with their
Twitter web apps.

Thanks for all your comments!

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Stuart Dallas — Mon, 05 Jan 2009 13:54:20 -0000

@missburrows: That's still not correct. The only time you need another users username and password is if you want to perform an action AS that user, which is pretty much limited to posting tweets and following and unfollowing other users. All requests for data such as timelines, followers, profile info, etc can be made by any user for any other user. The only limitation is that you cannot then get the timelines for protected users unless the user you're authenticating as is following them - which in my mind is not a big enough benefit to make it worth requiring passwords.

Assuming twitcrush doesn't send tweets on behalf of its users I can't think of any reason such a service could not run without requiring passwords. Tweeter (#40) does allow it's users to post tweets through it so Mark's comment is perfectly valid.

Don't get me wrong, I want to see Twitter support OAuth as much as the next developer, but I feel quite strongly that the negative press that is being generated around this subject at the moment is as much developers fault as it is Twitters. I also think people need to remember that OAuth will only provide two benefits over passwords...

1) Apps that require passwords can maliciously change said passwords and effectively lock users out of their accounts. One hopes this won't be possible through the new OAuth-secured API.

2) Twitter and users will be able to revoke permission for individual applications to use their account without affecting the other applications and services in use.

There is a major downside to OAuth in that it's far easier to build a phishing scenario when a user has to be bounced off another site to authenticate. I don't know if Twitter are taking steps to limit this risk but it's worth noting because the general attitude across most coverage of this issue has been that OAuth will make Twitter secure. It won't - nothing can.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Schmot Guy — Mon, 05 Jan 2009 13:23:44 -0000

@Kosso Frankly a desktop app benefits least from OAuth since you have to deal
with all the OAuth crap, and if an evil desktop app wants to be evil, then
it can do better evil things like install a keylogger rather than just post
spam to Twitter. Getting an OAuth token is nothing compared to local code.

If an app *wants* to use OAuth, well, ok, $DEITY bless them, but opening a
browser window to get credentials sucks.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

missburrows — Mon, 05 Jan 2009 13:10:08 -0000

@stuartdallas Perhaps, I oversimplified my comment, but the fact is, as Mark (#40) so eloquently stated above: "due to Twitterâ€™s current setup, asking for passwords is the only option if you mean to provide access to their protected API methods."

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Stuart Dallas — Mon, 05 Jan 2009 12:38:27 -0000

@missburrows: Absolute rubbish. To grab a users profile, including their avatar URL, all you need to do is authenticate. You can authenticate with your own account and get my avatar - you DO NOT need my password!!

Re: Is It Stupid to Trust Twitter Apps With Your Password?

missburrows — Mon, 05 Jan 2009 12:27:14 -0000

I just launched twitcrush.com a mere 3 days ago.
Users log in with their twitter username and password, so that we can grab their avatar.
(There isn't any other way to do it.)

I would hope that twitcrush users would approach 3rd party apps. the way I do. Investigate:
make sure it is a credible source, don't just blindly use it.

For more info about twitcrush:
http://arandproud.blogspot....

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Kosso — Sat, 03 Jan 2009 10:45:56 -0000

Of course, another solution for Twitter etc.-based developers is to create desktop apps using AIR
and use SQLlite for local data storage.

That way, devlopers can sleep easy knowing they're not having to bear the
responsibility of storing people's passwords and still deliver all the same
functionality - if not, more!

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Mark Armendariz — Sat, 03 Jan 2009 03:10:59 -0000

As the developer of the Facebook App, "Tweeter", I'm in the same boat as Scott Carter (1). I've done what I can to ensure my members' passwords are secure at all times. I also try to warn my members that they should NOT enter their password unless they plan to tweet through my application.

Unfortunately we've few other options until Twitter offer OAuth or some similar alternative. I've absolutely no interest in the passwords of my users and would much rather not have to manage them at all. Unfortunately, due to Twitter's current setup, asking for passwords is the only option if you mean to provide access to their protected API methods.

As in most cases, education is the best resolution. It always bothers me to get emails from distant aquaintences to join some service I'm sure they just wrecklessly offered their email credentials to so the app can "help find their friends." It's a poor practice and would be useless if more people knew just how dangerous it is to share their private credentials - especially their email password!!

Then again, if the general public knew better, spam wouldn't exist.

1: http://mashable.com/2009/01...

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Vance Lucas — Fri, 02 Jan 2009 10:34:25 -0000

The only 3rd party Twitter service that I fully trust with my username and password is TwitPic ( http://twitpic.com ), because I know the owner and have met him personally. He's a really great guy, and the service is solid.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Philippa — Fri, 02 Jan 2009 10:33:41 -0000

Yeah I think it is stupid. Im a little nervious cause I have a ping.fm account which has everything. We'll see.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

funkyboy — Fri, 02 Jan 2009 10:06:22 -0000

@M2Mz if twitter sells the buyer will send you another terms agreement to subscribe
(if different with respect to the current one). In any case when you sell, you sell everything, and you don't
have to ask permission to users.

In general I discourage anybody to provide login data to 3rd party applications, especially web apps, where
login data necessarily transit on 3rd party servers before arriving to twitter.

The case of desktop applications is rather different. Apps like Posty or Tweetdeck send data directly to twitter servers.
In principle they could send data also to 3rd party servers, but this is easy discoverable and - if it were
the case somebody would have already alarmed users :)

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Matt Albiniak — Fri, 02 Jan 2009 09:52:12 -0000

#28 / M2Mz wins. They brought up the real issue.

But to the question asked, yes it is stupid, but I still do it. The real stupidity is on us for not demanding a 3rd party auth (hello friendfeed, you do it right).

Re: Is It Stupid to Trust Twitter Apps With Your Password?

M2Mz — Fri, 02 Jan 2009 09:31:25 -0000

What if Twitter sells its site?

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Maxi Malone — Fri, 02 Jan 2009 06:50:14 -0000

I'm new to Twitter but agree with Suthnautr about using Firefox.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Suthnautr — Fri, 02 Jan 2009 04:57:34 -0000

Good points Andy, Marc and Brian (that one's scary - that a malicious app could have permanent access even if you change your password!) I'd like to add one thing - besides not updating or installing from the web, use FireFox with the "No Script" plug in and never visit any plug in site for the first time without it.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Marc Plancke — Fri, 02 Jan 2009 03:57:13 -0000

I change my vital passwords at least every two months. My passwords are all
unique and based on different languages, historical numbering systems and
a unique transformation algorithm I won't divulge, but to give you a general hint:
idea: study the Enigma system. Enigma was developed in a time computers did not exist.
exist. (THEREFORE?)these systems were more difficult to crack than computer
generated keys.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Brian Shaler — Fri, 02 Jan 2009 03:15:51 -0000

I'm sure people are scrambling to change their passwords. A while back,
I discovered that a malicious 3rd party developer could have permanent access
to users' accounts by logging in once. Even if you change your password, they
can still get back in and lock you out!

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Kosso — Fri, 02 Jan 2009 02:16:57 -0000

I don't see how OpenID will solve anything really, apart from mkaing it easier to change your
password across many sites from one place.

In order for just about any app/script to post/crosspost anything on your behalf, you
have to give them the rights to do that by giving the third party your details.
Twitter do not currently have a way of providing a way to do anything on your behalf withouth
using "username:password" in the call to the API.

It's all a question of trust at the end of the day.

Twitter do need to implement a secondary password/api key for this sort of thing though.
See how places like flickr/google/gdata/friendfeed etc do it.
I just means slightly more development to be done, which isn't as easy, but worth learning.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Roger Kondrat — Fri, 02 Jan 2009 01:35:47 -0000

I saw this site today and thought no way am I giving them that kind of access
to my email. I sign into twitter 3rd party apps and I don't care 95% of the time
because there is nothing valuable in my Twitter account. Realistically what are hackers going to do with my account? Nothing permanent for
sure.

What I would say is look beyond the login portion and evaluate what other
information is required by the organisation, some sites want your email address
and don't really have a good reason for it. If they don't have a good reason why
would they ask? Sites that require an email address are often being lazy in my
opinion, as there are ways of working around email.

Some above this comment are talking about OpenID and OAuth here but that is not
an answer in itself because OpenID will pass along your email address as will
OAuth so when they finally come to Twitter watch how many sites jump at the
chance to get your email address since they were unable to before that point the
issue was moot.

Just be smart and if you are not sure, Twitter is a community of friends so ask a
friend and see what their thoughts are. Lots of 3rd party sites are around pretty
much permanently so don't get in such a hurry that you sign up immediately upon
launch. IF you are one of those that has to be first then just have a dummy
account to try the service out for a while and talk to people (your twitter
community) about the site.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

hidama — Fri, 02 Jan 2009 01:31:59 -0000

And here I thought everyone learned their lesson with the Twitterank scare.

Perhaps Twitter users need to cool down, read what they so willing retweet, think about what they tweet, and carefully consider what Twitter apps, eRoi books, and bloggers they support.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

It looks like Stuart Dallas has already supplied us with a solution to the Twply problem. Doesn't solve the problem with other third party apps requiring a login, but it's really not as if people are uninformed when it comes to giving that sort of information away. Caveat emptor.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Suthnautr — Fri, 02 Jan 2009 01:27:24 -0000

For me the danger is limited only to Twitter since each and every account created by me has an entirely unique password. There was a time several years ago when I had only two or three: an "important accounts" one, a "medium sensitive account" password, and a "so what, it isn't my bank account" password but since then I use unique ones for everything. If you know an app has done
something unauthorized with your password or is selling out, change your password ASAP, and stop using "maggie" as the password for everything you do.

Simple brute force password crackers use text dictionaries to crack passwords and can be multi-loaded with any number of dictionaries including biographical names, fictional characters, foreign dictionaries etc. and easily set up to add numbers in varying combinations both before and after each.

I would never trust a third party Twitter app with access to any one of my 30 or so email accounts though - not for a minute. So my answer is maybe.

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Eric Polerecky — Fri, 02 Jan 2009 01:27:15 -0000

While I think facebook connect is one extreme twitters simple API is the other. Why can't they just do something like friendfeed and create an API key. The bottom-line is that twitter needs to do SOMETHING, ANYTHING on their end to manage the API a little better.

I just wrote, for fun...leaning the facebook connect API, a site that implements both and while the facebook stuff was a little much it just feels cleaner (in a its not dirty sense of the phrase)

fyi... http://pinggr.com ...both API's...facebook connect for login and status updates and twitter as one of the palces to send updates...

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Kiran — Fri, 02 Jan 2009 01:12:04 -0000

I appreciate Twitter's simplicity but this is ridiculous, asking us to provide the password to third party apps.
In a way Twitter is responsible for all the mess with Twply. I am truly amazed at how they are getting away
with this security hole. Its not like they have to invent something. Google, Yahoo, Facebook etc have implement secure third party accesses. Look to OpenID. It will take a week or less to implement a better authentication mechanism.

Twitter "Trust no one"

Re: Is It Stupid to Trust Twitter Apps With Your Password?

Jesse Luna — Fri, 02 Jan 2009 01:08:14 -0000

I answered Maybe because for many applications, it's necessary to pass in the username and password information to access certain data via Twitter's API. And we're talking *basic* info. For some applications that tweet out messages, it's the only way to accomplish that. I do like the "workaround" that Stuart Dallas came up with but there are some pieces of data that can not be accessed that way.

That said, trusting an application to store your information, especially a totally new starup is very questionable.