Security & Privacy Archives

Twitter’s had a torrid few months and continues to have problems with error rates and API calls, but that’s simply scratching the absolute tip of the bugs and issues iceberg.

Here are five big holes that Twitter needs to fill.

Staff

Twitter is clearly understaffed. The company is actively hiring – there are 39 vacancies at the time of writing – and that’s a good sign, but they really need to step it up.

The company has documented their void in engineering, but of equal concern is the size of their support team. @Delbius et al do the best they can, but more often than not support enquiries still get little more than an auto-responded list of frequently asked questions and a rapidly-closed ticket.

I’m not sure exactly how many of their 241 current employees work in support, but I do know that only three of the 39 vacancies are in this area. In both cases, it isn’t enough – only 11% of my readers rate Twitter’s support as good to excellent. A whopping 79% rate it as below average to terrible.

Better Privacy Solutions

As I’ve documented on various occasions on this blog, Twitter’s block is not actually a block at all. The only way to get true security on your updates is to make them private. There needs to be a middle ground.

Read the rest of this entry

Time for another rant. My usual disclaimer applies.

Your Twitter Background Is Free And Off The Shelf

5 Mistakes You’re (Still) Making On TwitterHere’s the thing – customised Twitter backgrounds are largely a waste of time. Until Twitter decides to make them interactive and allows us to add links and apps and other customisable options – which could perhaps let them compete with Facebook pages – unless you’re very important there’s really not a lot of point in spending a lot of time and effort on your background.

By and large, and because there’s not much to do once they get there, people only tend to visit your profile page directly (and thus see your background) a couple of times – once, when they’re deciding whether to follow you when you’re an unknown quantity, and possibly a second time when they’re trying to remember who the heck you are a few months later.

If you simply must have a background, you’re better off customising it yourself (perhaps utilising the services of your favourite designer pal), using a simple (and original) tile, or even one of Twitter’s options, than you are using a freebie service that proudly displays TWITTERBACKGROUND.ORG on the top-left of the page. Not only does that look lame, it is lame.

And even if your background is absolutely first class, remember that different monitor sizes and screen resolutions mean that all those email address, URLs and telephone numbers you carefully placed on the left sidebar can be completely invisible to those millions of people using netbooks and mobile handsets.

Unless you’re very skilled and/or can put together something absolutely incredible – that works on any screen size – it really isn’t worth going to too much trouble. Read the rest of this entry

Lots of people get a real kick out of checking in at places and reporting their current location. I’m have to say that I’m not one of them. However, if this is your kind of thing, you’ll soon be able to do this easily on Twitter with a new featured called Twitter Places.

We’re excited to announce Twitter Places on twitter.com and mobile.twitter.com. Starting today, you can tag Tweets with specific places, including all World Cup stadiums in South Africa, and create new Twitter Places. You can also click a Twitter Place within a Tweet to see recent Tweets from a particular location. Try it out during the next match—you will be able to see Tweets coming from the stadium.

Other features include:

  • Foursquare and Gowalla integration
  • API functionality that lets developers integrate Twitter Places into their applications
  • Support for more browsers (including IE)

You’ve been able to do something similar to this on various mobile apps for a while now, but Twitter has made it all official and built-in. Enjoy.

(Source: Twitter blog.)

There’s another phishing attack on Twitter, and yet again it’s being spread by direct message.

(You can read all the details over at Mashable.)

Here’s what I think you need to do. If you get any of these malicious direct messages, please don’t click on the links, but do make a note of the user(s) that sent them to you. Is that name familiar? Have they fallen foul of these phishing scams before? Several times?

Yet Another Phishing Attack On Twitter – Please Protect Yourself By Unfollowing Repeat OffendersDo they always seem to be affected by these kinds of exploits?

If so, unfollow them. Don’t hesitate, do it right now. And seriously, seriously consider a block, too.

Reality check: it’s probably a safe bet that virtually every single one of us will be conned by something on the internet before we bite the dust. As human and artificial intelligence-slash-guile continues to develop, we’re all potential marks.

People make mistakes, and when something happens to somebody else on Twitter it’s fantastic if you can take a moment to explain to them what they did, and hopefully educate them enough so they won’t do the exact same thing a month or two later.

But if you have users in your network who are always getting tricked, and who are repeatedly getting their accounts compromised, then you need to let them go. Because nice as they might be as people, as long as you’re connected then their neglect and technical naivety becomes yours (by proxy).

It’s a phishing attack today – it might be something a heck of a lot worse this time next week. This might seem harsh, but this is your security at stake. And while there’s any kind of link between you and them, and despite how savvy you think you might be, the odds of YOU getting caught out will continue to increase dramatically each time they screw up.

(PS. If it makes you feel better, send them an email or open tweet explaining why you had no choice. Just don’t click on any links that they send back.)

Over at the official Twitter blog, there’s news of a new internal URL shortener that Twitter has added to the platform.

The shortener, twt.tl, cannot be accessed directly at the moment. Instead, Twitter plans to route all submitted URLs through this new service so that it can “detect, intercept, and prevent the spread of bad links across all of Twitter”, adding that even if a link is shared by a different method (i.e., email notification), they will be able to keep the user safe.

Since these attacks occur primarily on Direct Messages and email notifications about Direct Messages, this is where we have focused our initial efforts. For the most part, you will not notice this feature because it works behind the scenes but you may notice links shortened to twt.tl in Direct Messages and email notifications.

It’s worth noting that when you see a URL shortened to twt.tl it doesn’t mean that the contents of that link are bad. One assumes that when malicious data is contained within a link, Twitter will simply re-route the user through to a stop page that prevents them from being affected, hopefully with an explanation as to what happened, alongside some encouragement not to retweet.

More details as they emerge.