So, one of the big attack modes in computer security these days is "phishing". Phishing is when someone induces a victim to disclose a username & password (or other important identity information) using something that appears to be a valid website. For example, someone might setup a fake Bank of America website, then email that link to thousands of people asking them to login and confirm their account. Even if only 1% of the recipients falls for the trick, the attacker gets access to hundreds or thousands of bank accounts.
One of the most important countermeasures to this attack is user education. Organizations have spent lots of money trying to educate users that they should never disclose their password to another site. Things as simple as never opening links from an email and verifying the "SSL Lock" icon on your browser are cornerstones to this process. But more importantly, users should never give their password to a site with the wrong URL. In our example above, if the link in the email goes to http://bankofamerica.com@geocities.com/~spammer/fake_login.html, the goal of user education is to get the user to stop and say "Hey, that doesn't look right...." In fact, social media pioneer MySpace spent a lot of time and effort combating these exact types of attacks through user education efforts on their login screens and banners.
That brings us to Twitter. There appears to be a whole universe of Twitter related tools and websites that ask you to use your Twitter username and password to access their services. This is a bad idea! First, in the specific instance, we are building up a huge body of websites with access to our Twitter accounts - a break in at any of them could result in massive compromise of Twitter accounts, regardless of Twitter's policies and security controls.
But more importantly, Twitter's importance to the "youngins" means that we're now raising a whole new generation of Internet users that are 1) vulnerable to exploitation because of their age and now 2) trained by prior experience that sharing their username/password with other sites is a good idea. Now, I'm not one of those people that will do anything "for the children", but this is still a scary prospect.
And before you pooh-pooh me, how many of you out there are using the same username and password for a lot of your social media sites, email accounts, Amazon, Etsy, etc.? I'd be shocked if most kids have strong passwords let alone separate passwords for all the different sites they use on a daily basis. So these phishing vulnerabilities are only going to be more important as time goes on. And the really scary thing - even if you and your kids are smart enough to avoid these pitfalls, the vulnerability has what we call a "network effect". Even if YOU aren't vulnerable, someone you're connected to probably is. And that can be just as bad. Think your 13 year old would never talk to strangers online? What about when his friend's account is compromised and some stranger is using that friend's Facebook or Twitter to talk to your 13 year old? Still feel safe? Think you would know better even if your 13 year old wouldn't? What if your best friend sent you a Facebook message to let you know that the party tomorrow is cancelled? How paranoid are you willing to be....?
What can be done? Well, for starters, Twitter should implement an API Key approach to programmatic sharing like the one used by Flickr (or some other well engineered security mechanism for sharing access). Then they need to lead the charge in educating users not to share their passwords with a site that doesn't end in "twitter.com". And parents, don't forget to spend some time with your kids - and not just explaining this stuff!
