News for hackers. Stuff that matters.

A comment on Twitter said to be testing two-step security in wake of AP hack.

Re:Twitter said to be testing two-step security in wake of A... by citricsquid on Wednesday April 24, 2013 @08:26AM (#5601058)
A few years ago there was a strange byline on a few tweets from @spam, it said "by {username}" indicating that there was some sort of system allowing specific users to send tweets from a different account, here is a screenshot from January 2010: http://i.imgur.com/o0iVS.png

Does anyone have any insight on why Twitter haven't implemented that sort of system (nominated accounts able to tweet from a corporate account) and seemingly abandoned the idea in 2010? One of our Twitter accounts has ~30,000 followers and we have to share the password amongst the company in a spreadsheet, that sort of poor security is encouraged by a single login model, with all the previous high profile account compromises it seems strange Twitter hasn't addressed this before. Maybe someone knows why, or can speculate why?

[ Parent | on HN ]
Re:Twitter said to be testing two-step security in wake of A... by nchlswu on Wednesday April 24, 2013 @08:51AM (#5601159)
Is that at all mitigated by tools like HootSuite or other corporate Twitter clients that allow multiple people to manage an account?

I'm not saying that it's acceptable that Twitter leaves that in the hands of vendors/users, I'm genuinely curious and wondering why the idea was parked in the first place.

I'd guess that it is part of a future offering from Twitter, but who knows.

[ Parent | on HN ]
Re:Twitter said to be testing two-step security in wake of A... by bcherry on Wednesday April 24, 2013 @03:31PM (#5603444)
This is the "Contributors" feature, which has been tested internally and with a few partners, but has never been widely enabled. It's in the public API, but still disabled for all but internal accounts and those few partners. https://dev.twitter.com/docs/api/1/get/users/contributors

I don't have any current insight into the status of Contributors, and won't speculate, but the feature has been stagnant for almost 3 years now (just like Lists).

[ Parent | on HN ]
Re:Twitter said to be testing two-step security in wake of A... by smackfu on Wednesday April 24, 2013 @10:42AM (#5601707)
Depends... Which is a worse attack vector: a single account with a shared password, or a shared account where each person has their own personal account password?

Twitter really needs shared accounts + required two-factor for the personal accounts.

[ Parent | on HN ]
Re:Twitter said to be testing two-step security in wake of A... by benmccann on Wednesday April 24, 2013 @11:21AM (#5601945)
At the very least it's better for auditing. If one of your employee's accounts is hacked to send a fake tweet you immediately know which one instead of potentially having no way to know.
[ Parent | on HN ]