Re:Rails Template: Create a Twitter Application in Seconds
by mbleigh on Friday April 03, 2009 @10:20AM
(#544922)
This Rails template uses Twitter OAuth, meaning you don't give away your username and password for Twitter. If an application "goes rogue" and starts posting unsolicited tweets or doing other nefarious practices, you can simply revoke access to the application from your Twitter account's "Connections" tab.
Twitter has a "Delete" option for Tweets so you could just manually remove any forged tweets. Of course you should still always be careful what services you associate with your Twitter account.
Re:Rails Template: Create a Twitter Application in Seconds
by zanders on Friday April 03, 2009 @07:03PM
(#545814)
I always wondered what scenario I would have to revoke access. Thanks for the going rogue example. Any instance where that's happened to date?
Re:Rails Template: Create a Twitter Application in Seconds
by ivankirigin on Saturday April 04, 2009 @08:53AM
(#546292)
Tipjoy is filled up via PayPal, but not tied to your account. You can't pull more money than you already put in there.
Tipjoy could be compromised by phishing of either your Twitter or your Tipjoy password. This is equivalent to PayPal.
We allow a 3rd party to create a link to sign in a Tipjoy user, which requires a Twitter username & password, and eventually will work with OAuth: http://tipjoy.com/api/#create_login_link
This isn't a big deal considering you can just tweet a payment with those same credentials. http://tipjoy.com/api/#creating_twitter_payment
We'll eventually become an OAuth provider, instead of using Twitter credentials.
However, am I wrong to think that this is still a terrible phishing accident waiting to happen?
I guess the worst that can happen, at this point, is that someone phishes your Twitter password. Assuming that nobody is crazy enough to use Twitterauth for logging into email or (god help us) a bank account, all one can do with someone's Twitter password is log in to Twitter and other Twitter applications.
But, wait... doesn't Tipjoy let a thief empty my bank account by Tweeting money to other people?
[Scramble to read the Tipjoy FAQ.]
Ah, the black hat can only give away the amount that is in my Tipjoy account, which has to be funded via (e.g.) Paypal. But can the thief log into Tipjoy using my Twitter credentials and then initiate a transfer to Tipjoy from Paypal or my bank, via stored credentials on Tipjoy? I have no idea.
But perhaps you're only allowed to send out a tiny amount at a time. Or there are steps to take to roll back the transactions in case of fraud (credit card chargebacks, if nothing else) -- perhaps this is a problem for my credit card company, Paypal, and/or Tipjoy, but not for me. And presumably I and/or my followers might notice fraud fairly quickly, since outgoing Tweets are much more visible than (say) outgoing email.
(Perhaps the next business opportunity is a service that monitors your Twitter feed for suspicious-looking activity that might not be your doing... ;)
Does Twitter have an appeal process for removing forged Tweets from one's account?