[FSC] Twitter Spam and the OAuthcalypse

Twitter discontinued support for basic user authentication in third-party applications yesterday morning.

Good. It's always best to never share your password with a third-party. Even if you trust them, their database could be compromised, and your password along with it. The discontinuation of basic user authentication also removes the vector of brute force password attacks via Twiter's API.

All third-party applications must now use Twitter's OAuth.

http://www.f-secure.com/weblog/archi...hcalypse01.png

So, that being the case… we have a feature request.

The other day, we came across some Twitter spam using a bit.ly link that pointed to an application called "Lady Gaga photos".

http://www.f-secure.com/weblog/archi...hcalypse02.png

If you "Allow" the application, two things will happen: the account tweets spam and follows two new accounts (emoboyxx3 and BoyGeorge).

We don't suspect Boy George is behind this…

http://www.f-secure.com/weblog/archi...hcalypse03.png

Okay, so it's a spam application. Time to visit Settings/Connections and revoke its access.

http://www.f-secure.com/weblog/archi...hcalypse04.png

And here's our feature request, we want a "Revoke Access and report as a spam application" as well as the "Revoke Access" option.

Cheers! On 01/09/10 At 03:36 PM

**Hidden Content: To see this hidden content your post count must be 1 or greater.**