Twitter Security Issue

#1

Post by swdesignguy » Mon, Nov 24, 2008, 12:44 AM UTC

Re: Twitter Security Issue

#2

Post by ivankirigin » Mon, Nov 24, 2008, 12:59 AM UTC

How about this for a twitter security issue: users are accustomed to giving their passwords to many third party twitter-API apps.

Re: Twitter Security Issue

#3

Post by tlrobinson » Mon, Nov 24, 2008, 1:43 AM UTC

ivankirigin wrote: post #2

How about this for a twitter security issue: users are accustomed to giving their passwords to many third party twitter-API apps.

Yeah they need to implement OAuth or something similar.

Re: Twitter Security Issue

#4

Post by tlrobinson » Mon, Nov 24, 2008, 1:45 AM UTC

I suspect this is actually a very common issue. Unless you explicitly expire all sessions for a user when they change their password then this will happen.

Re: Twitter Security Issue

#5

Post by bretthoerner » Mon, Nov 24, 2008, 2:07 AM UTC

tlrobinson wrote: post #4

I suspect this is actually a very common issue. Unless you explicitly expire all sessions for a user when they change their password then this will happen.

Common? Maybe.

Good? No.

Re: Twitter Security Issue

#6

Post by laut » Mon, Nov 24, 2008, 6:45 AM UTC

Users should be encouraged to not share their password with anyone or anything, but twitter. 3rd party apps could use OAuth.

Re: Twitter Security Issue

#7

Post by sh1mmer » Mon, Nov 24, 2008, 7:44 AM UTC

Twitter have said they are going to implement OAuth (which would solve this problem) on their API page. However, they have shown no progress to my knowledge of doing this. It would be great for the community to push them towards it.

Twitter seem to have been so busy fire fighting that a lot of interesting stuff has seemingly dropped off the roadmap (such as XMPP).

Re: Twitter Security Issue

#8

Post by aston » Mon, Nov 24, 2008, 8:19 AM UTC

The fix for this sort of thing is pretty simple. Just keep a nonce on a user (the "user version" if you will) that increments every time a user makes a change to their login credentials, store that nonce in their cookie, and if the one in the cookie is lower than the one on the server treat it as a logout.

That said, this is sort of an unserious security "issue" for most people between not really caring about the security of their account and reasonably short cookie lifetime settings.

Re: Twitter Security Issue

#9

Post by kajecounterhack » Mon, Nov 24, 2008, 10:44 AM UTC

tlrobinson wrote: post #4

I suspect this is actually a very common issue. Unless you explicitly expire all sessions for a user when they change their password then this will happen.

Well when you say common, do you mean with another application that utilizes an open API that is connected to many popular platforms and that is as widely used as Twitter?

Not many come to mind.

Re: Twitter Security Issue

#10

Post by bluelu » Mon, Nov 24, 2008, 12:26 PM UTC

Surely Blaine Cook didn't want to give up the admin account he had access to. ;)