Why you should change your Twitter password NOW!

Written on 5th March 2009                                                                                                              11 COMMENTS
Patrick de Laive, Internet entrepreneur and co-founder of The Next Web Conference. Twitter: @patrick

The news from Spotify being hacked once again shows that your data is not always safe. Even if you trust the company that holds it for you.

Most users know that they should use a different password for each service they use. But from personal experience I know that we don’t always do what is right. Most people use the same password for all their services.

The danger of using the same password:
Most web developers know that you should never save a password in plain text format but sometimes that just isn’t possible. Take Twitter, or any company with a popular open API.

While Twitter (hopefully) uses a hash for their users passwords, it is the Twitter ecosystem (the hundreds of services that are build around Twitter) that you should be worried about. Since Twitter doesn’t have a safe authentication method for their API (like oAuth) these services need to know your username and password in plain text (ie unencrypted) to query the Twitter API.

If you are a passionate Twitter user you probably use a lot of external twitter apps. What you get is hundreds of places where your Twitter password is vulnerable to hacking attempts.

As it is so easy to build a service around Twitter, and many of them have been build in less then 1 day or week, you can imagine that security is not the highest priority for these Twitter projects.

A hacker could probably hack Twitter services more easily than Twitter itself. What he/she would find is your Twitter username and password and in some cases even your email address. Obviously the hacker could abuse your Twitter account, change your password, sell your credentials, stalk you followers and more.

Given that many people use the same username/password combination for many different online services these hackers could also try to log into other web services such as gmail, flickr, Google docs and Yahoo.

In short, it’s a good idea to have a separate password for services like Twitter and don’t use the same password for different services. Use a password generator such as 1Password if you want to make sure your passwords are secure.

An extra benefit to changing your Twitter password is that you automatically filter out the services you don’t use anymore.

Thanks to Robert Beekman for the input.

API, developers, FG*hj3#4@h, guess my password, hacked, hackers, oAuth, password, passwords, security, trust, twitter, username, vulnerability

11 Comments »

Fill in the blanks, track your alias on Usernamecheck.com

Written on 27th October 2008                                                                                                              9 COMMENTS
Ernst-Jan Pfauth, editor in chief

Until two weeks ago, you’d regularly find articles of Robin Wauters on The Next Web Blog. The last post the next web enthusiast & Plugg organizer wrote, was titled Matt Mullenweg snaps up PollDaddy. The next day, Michael Arrington snapped up Robin Wauters. Yes, our Belgian editor got promoted to TechCrunch. Goodbye, farewell and trackback!

Well, yesterday I received the first trackback from Wauters, now it’s my time to return the favor. Not just because he’s a great guy, but mostly because he discovered a cool tool: Usernamecheck.com.

It took me or two or three usernames before I realized it’s better to have one. Not just because it’s easier to remember, but also for personal branding matters. So I chose “dutchproblogger”. I’m sure you have an alias as well: Usernamecheck allows you to see whether that nickname is still available on 68 services.

According to TechCrunch commenters, the service isn’t functioning perfectly, yet you’ll get the idea anyhow.

As you can see, I suck at registering with the right username, some are more fanatic about it:

So be ahead of the “asswipes” out there and fill in the blanks, a.s.a.p.!

Michael Arrington, personal branding, Robin Wauters, scobleizer, TechCrunch, username, usernamecheck.com

9 Comments »