Stop Sharing Your Twitter Credentials

http://blog.twitpay.me/2008/12/10/stop-sharing-your-twitter-credentials/

by boorad • 18 years ago

50 33 18 years ago

blog.twitpay.me

axod3• 18 years ago

"since they don’t yet offer OAuth"

OAuth wouldn't solve the problem though, it'd just move it somewhere else.

Use a different login for each site - use a password manager.

dbrown264• 18 years ago

That's a good point. OAuth would at least centralize the problem towards a more trusted source and limit the number of places the credentials would be stored. I trust Google or Facebook to have more safeguards in place than a webapp that popped up yesterday. As for password managers, I totally agree people should use them, but as a practical matter, most non-tech people do not.

axod3• 18 years ago

You trust Google to control all your logins ;) I have a cautionary tale to tell about that one...

ivey2• 18 years ago

Agreed on the password manager. I've got 1Password in Safari, and the "Generate Password" option is so easily available it becomes second nature.

andreyf• 18 years ago

Sounds like that would make it much harder to switch browsers...

tav• 18 years ago

http://duckduckgo.com/?q=pw

spydez• 18 years ago

I prefer https://www.grc.com/passwords.htm for my random password generation needs...

notdarkyet2• 18 years ago

Seems like a spam account. Created 10 minutes ago to promote duckduckgo.com.

tptacek5• 18 years ago

Only a tiny fraction of users are ever going to find out what a password manager is, so you really haven't addressed the article's point.

ivankirigin2• 18 years ago

Continue to share your twitter credentials with sites you trust, but stop once they implement OAuth.

Consider the rampant use of twitter clients. Should you stop using them? Stop trying new ones?

No.

tptacek5• 18 years ago

You're sidestepping the point of the article. Ivan Kirigin is not going to get screwed over by a website that asks for his Twitter password. But my mom might, because it is extremely likely that one of these fly-by-night Twitter add-on apps will lose their database to some stupid SQLI bug. My mom almost certainly uses the same password for Twitter and Yahoo Mail.

Moreover, each app that asks for passwords for another service adds social proof that this is how we build applications. It isn't.

ivankirigin2• 18 years ago

My comment is directed to this community.

I agree 100% that asking for passwords is a very bad practice, and users shouldn't be trained to do it. They should fix it immediately.

I suppose people could stick to twitter.com and sms - but to me, the defacto twitter world has clients. They are important. I want people to use them. Give your password to sites you trust, Mom.

chime• 18 years ago

1. Twitter users give any odd site their Twitter username and password. 2. Twitpay and Twitter now have the ability to pay other Twitter users via simple tweets.

So all someone has to do is create a Twitter-app that collects username and password for 10,000 users and randomly starts paying themselves. What could go wrong?

dbrown264• 18 years ago

Well for one, Twitpay has checks in place to limit the amount that any one account can send or receive in a given time period.

jackowayed2• 18 years ago

Twitpay doesn't let you link it with a credit card or anything. You have to authorize the paypal payment anytime you want to add money to it, so the only money someone could take that way is the money you leave in your account.

danw• 18 years ago

Twitter is currently trialling OAuth on its API which will be available as a beta soon http://apiwiki.twitter.com/REST+API+Documentation#Authentica...

giles_bowkett• 18 years ago

this was a really, really foolish post in my opinion. you want to build your business on how users really act, not rant at them for acting differently than you expected.

besides, it just shows how bankrupt passwords are. we use the same mechanism online to protect our bank accounts and our most meaningless babble. that's just trouble waiting to happen.

building a business on that is like a building a house on the San Andreas faultline and then filling it with priceless Ming vases. it might be fun, might look nice, but it's not exactly strategic.

dcurtis• 18 years ago

Im surprised no one has mentioned OpenID.

It has pretty much failed at this point, but it was sort of an attempt to fix this problem.

jackowayed2• 18 years ago

I'm actually working on a twitter app that needs passwords that's soon to launch (http://tweetlinkmonster.com/ if you want to see. You can signup if you want, it works and is secure. I just want to polish before really launching.)

For now I take people's passwords (I don't have much choice. I need to get someone's friends timeline.)

I'll proably go ahead with that for now, but I'd love to do OAuth when Twitter releases it. But I'll probably go ahead with the current plan for now.

The issue is that there are many Twitter apps (mine, twitpic) that have no choice but to take passwords.

Twitpay can get away with it, but anything that needs to tweet for the user or get the user's tweets has no option until Twitter adds OAuth.

phunk• 17 years ago

With every twitter account I feel like squatting on (and, oh , btw, yes everyone does it), I create a not-too-close gmail account for use with just that twiter account (for verification), and use that to test the 3rd party apps that "Must" have your twitter creds in order to work. What I have found, by trial and eror, is that over half of ALL the currently available (and some beta) 3rd party apps work PERFECTLY WITHOUT any signup or twitter cred. So why do THOSE particular 3rd party apps need the info? I doubt they need it for future growth of the app or "extra features" later.

Stop Sharing Your Twitter Credentials

Related Stories