January 06, 2009

Walls, Blogs, and Power: Building Fortress Twitter

By Eric Berlin of Online Media Cultist (FriendFeed/Twitter)

The race to build the perfect Twitter add-on service is in full bore. There are so many new services and applications being delivered these days that new sites are cropping up exist solely to aggregate and organize all the cool stuff that's being built on top of Twitter's open API. For example, Twitterati notes that the goal of Twitdom is "to provide a consolidated view of all the applications developed for the Twitter ecosystem."

Some have argued that Twitter's relative simplicity may be a factor holding it back from going "mainstream." While I disagree – I believe that Twitter's strong growth will continue – I have been keeping a close eye on those applications that add value to the basic Twitter service to create what I call "Twitter Pluses." In a sense, the Twitter Pluses could be thought of as iterations of the base platform that Twitter itself could hypothetically adopt for itself.

TwitWall
The first Twitter Plus that took my notice is called TwitWall. You sign in to TwitWall using your Twitter login and password (the ongoing Twitter phishing plague will make people nervous about doing this for a while, but that's a different topic, I'm afraid) and are brought to a profile page that looks much like your regular Twitter page.

There are two main features that make TwitWall interesting. The first is the ability to add posts longer than the standard 140 character limit that Twitter imposes. The idea is that you can tweet away under the normal 140-max, but you also have the ability to add additional text, images, and video that appear on the TwitWall "side." This is a way to increase the range of Twitter's microblogging platform for those who are interested in doing so.

TwitWall also allows you to insert ads into the right column, giving microbloggers the ability to monetize their microblogging efforts. This goes a ways towards making Twitter the "full-fledged publishing platform" that I talk about here.

A challenge that TwitWall will have to solve to really take off will be to solve the problem of multiple communities within the Twitterverse. In other words, most people are probably not going to want to add TwitWall friends on top of the normal process of fleshing out a Twitter social network.

Twitblogs
Twitblogs, a service that was released to the public recently, is similar to TwitWall but has fewer features thus far and a somewhat rougher-feeling interface.

I chatted recently via e-mail with Roger Kondrat, co-founder of Twitblogs, who notes that "we are going to add lots of value to the Twitter community but that won't be obvious for a couple weeks yet. Until then Twitblogs will at the very least give users a more flexible way to engage on Twitter using Rich Media such as images, video and sound as well as the additional characters 140+ that so many found useful on other services non-Twitter services."

Power Twitter
Power Twitter, covered by TechCrunch this week, is a Firefox add-on that amongst other things fuses the popular Twitter search service (formerly Summize) into the Twitter profile experience itself. Overall, Michael Arrington muses that "this is the way to fix Twitter, directly via the user interface, not from a third party site that users will forget to go to.

My opinion is that while most of these services add value in different ways, Twitter doesn't need to be fixed in the first place: it works just fine as is, but the bevy of new services and add-ons allow the various factions of Fortress Twitter to customize the experience in many different ways.

Read more by Eric Berlin at Online Media Cultist

January 05, 2009

DRM = Doesn't Really Matter

If one of the biggest items to be delivered at tomorrow's MacWorld Expo is the elimination of DRM from songs on the iTunes store, as is rumored, then we are on the brink of the biggest snoozefests in technology event history. Forget that Mr. Steve Jobs potentially is suffering hot flashes, and is instead being replaced by Cupertino's wild-haired Pillsbury Doughboy, Phil Schiller. This Macworld has got to be the lowest-anticipated in terms of new product debuts that I can ever remember. And when it comes down to it, despite all the online horror and tongue-lashings, I'd venture a bet that the supposed evils of DRM that Apple has wrought on its users haven't really effected but a small percentage. I don't love DRM, but I live with DRM, and it doesn't really matter.

When Apple introduced iTunes and marketed it with the "Rip. Mix. Burn." campaign several years ago, music labels were furious, thinking the Mac-maker was embracing piracy, a second back to back blow to the maligned monopolists following Napster's runaway success. When Apple introduced the iPod in 2001, and later the iTunes Store in 2003, it had to bend over backwards to gain the cooperation of the labels, restricting who could play what songs when on what computers or iPods, and how many times they could burn playlists to CDs, all in the name of preserving profits.

Over time, some of the DRM rules were relaxed, and the advent of iTunes Plus meant you could some songs from iTunes without rights management, for an additional fee of 30 cents a song. The additional 30 cents, in theory, meant you could do whatever you wanted with the file, just like you can with any hard copy you own, be it cassettes, CDs, etc.

Although I've been an iPod user practically since the first day they were announced, and followed the Apple upgrade path through to my current 16 GB iPhone, and I now own almost 6,000 songs on iTunes, a significant percentage of which were purchased from the iTunes Store, I almost never encounter any issues with DRM. I've upgraded my laptop a few times, moving my data from one computer to the next and authorizing the new machine. I've synchronized new iPods and the iPhone and always been able to play them. My music plays on my Apple TV, and can be streamed from my wife's computer on our same network.

That my music is slathered over with Apple's proprietary DRM is not a big deal, period. I would practically have to go out of my way to find a way that having "suffered" through DRM for the better part of eight years with Apple has negatively affected my music experience. I do know that I certainly am better off than those who chose subscriptions with music companies that have disappeared and gone out of business. I'm better off with my digital music here than in stacks of CDs around the house. In fact, I gave all my CDs away to a co-worker when the babies were born as part of cleaning house!

For eight years, I've wondered if the fact I didn't care about DRM was because I am a hopeless Apple fanboy. Maybe I've fallen under the spell of believing Apple should make the rules for how I use what is ostensibly my music and media. But seriously, the drama of DRM and its limits has been so overhyped I don't even know where to start. If you want to buy your music somewhere else, go for it. There are alternatives. But there's a reason iTunes, iPod and iPhone have been such a success. It's because of what they let you do, not what they don't let you do. It's the best combo on the market, and I don't care one bit about the DRM wars which just might be coming to an end as we know it tomorrow. I never have.

40 Key Elements to Getting Started In Social Media

By Mike Fruchter of MichaelFruchter.com (Twitter/FriendFeed)

Getting started with social media, whether for personal or professional use, requires learning the basic fundamentals. Social media is more than just creating a blog or Twitter account. The tools are great and give us big advantages, but they are simply extensions of how we engage and participate in social media, they are not the answers. The social in social media is all about the human element. This post touches upon 40 key elements to aid your success.
Branding, personal or professional starts with your domain:

1) Register your domain name. It's also a good idea to register it for multiple years. If you have extra cash up front, spend it. There is no need to be bothered with yearly domain name renewals, and, in a worst case scenario, risk losing your domain name. It's a good idea to set your domain registration on auto-renewal if you decided to renew yearly. Stay on top of the credit card you have on file as well. Auto-renewal notices, getting marked as spam, combined with an expired credit card is bad news. This happened to a friend, just a word of advice.

2) If you are an individual and your goal is personal branding, use your first and last name for the domain, and preferably a dot com extension as well. The domain spelling should be equivalent to someone typing that keyword or phrase into a search engine. It should be as short as possible and easy to spell. If you are business, be sure to register any variations and extensions of your domain name. The last thing you need to be doing is negotiating with a domain squatter, paying a premium down the road when it would have cost you next to nothing initially.

3) Find a reliable Web host, and do your homework. When you are just starting out, it’s practical and economical to go with the cheap shared hosting plan, i.e. Go Daddy.

4) Expect to upgrade your hosting plan at some point. When you have a steady flow of traffic and people are taking notice, sharing your content, digging it etc, be prepared to spend some extra coin for the next level of hosting. Do not be concerned with getting on the front page ofDigg in the beginning. If it happens, great, but there is no need to spend the extra cash beforehand. If things get really rocking at some point, perhaps you are making some coin off your blog or non blog website, traffic is flowing, server resources are being taxed, you are registering multiple domains, and establishing multiple websites/blogs, then you should look at a basicVPS server. The bigger you get and the faster you grow, the quicker you need to be thinking about moving away from shared web hosting.

5) Familiarize yourself with the basics of web-mastering. If you have not already done so, learn how to use FTP. Learn the basics of HTML, and how to configureDNS for your domain names. Learn how to configure a POP email account, and how to take a screen shot and edit and resize images. The less you have to rely on someone for these basic tasks, the better off you will be and you might even save some out of pocket expenses.

Blogging:

6) There are a number of different blogging platforms available to choose from. They all pretty much do the same thing, but your first obvious choice should be Wordpress . The majority of blogs on the Internet are all powered by Wordpress, and for good reason. It's a stable, proven platform and it's highly customizable. There are also a few thousand readily available themes and plug-ins made for it. There is also a huge developer community behind it, and plenty of resource sites dedicated toWordpress users. This one is a no brainer folks.

7) You should self host your blog on your own server. I would avoid using a web-based blogging platform. There are limitations to what you can and cannot do with these services. If you must use a web-based blogging service, you must be able to mask your blog to a domain name. There is a price to pay for this though, and you should ask yourself, is it really worth it? For the $10.00 priceWordpress charges, add five dollars more and you can buy a domain name and cheap self hosting. I see little value in using a web-based blogging platform, and not masking it to a domain name. Do you want people to remember mikefruchter.wordpress.com ormikefruchter .com? Brand yourself, not the blogging platform. Trust me they are making enough money, why make them richer? Most hosting companies who offer even the cheapest hosting packages offerWordpress installs for FREE. Take advantage of it. You need to be in full control of your blog, starting with owning it on your own server.

8) Keep your blog simple, avoid the clutter at all costs. Clutter equals slow page load times for starters. The more third party widgets you install, the more you are pissing off your readers and potential customers. Only install widgets that instill some value to your blog. Widgets such as MyBlogLog allow for referral stats on the backend, and on the front-end allows for community building. Twitter widgets show your present status updates and or allow people to follow you. This is the value I'm referring to. Keep the junk for your personal blogs, or if you must, put it on an entirely separate page altogether.

9) Find and install the necessary plugins that will benefit your blog, such as SEO plugins. Installing a caching-system plugin is also a good idea. You need to optimize not only just for search engines, but also page loading time. Find a simple theme and build around it. KISS is always a good rule of thumb. Appearance is everything, and your blog is no different. You never get a second chance to make a first impression.

10) Change your blog permalink structure immediately. By default, WordPress uses web URLs which have question marks and lots of numbers in them. This will severely limit the amount of traffic you will see from search engines. You need to be thinking SEO at all times, and this is the first step you should take with your blog. Your permalink structure should look something like this, www.myblogontechnology/this-should-be-your-permalink-structure. Do you see what we did here? We inserted the relevant keywords into the url. This is crucial in terms of optimizing for search traffic. With the practices of some additional SEO basics, there is a good chance we could achieve higher rankings for the keyword phrase of (this-should-be-your-permalink-structure.)

11) Tell people what your blog is about, and most importantly what you’re about. Create an about page. When I find a blog I like, and want to know more about the author, the first thing I will look for is an about page. A big turn off for most people is finding a great blog and not knowing anything about the person behind it. This can also lead to wasted business opportunities. The about page is just another extension to sell yourself, your credentials, your affiliations, your experiences and so forth. Show your readers you are just like them. Show them your personal side. This is what social media is all about.

12) Show your human side by using visuals. Add a real picture of yourself on your blog and on all of your social networking profiles. The picture should be of you and not of some silly cartoon character. As with real life, image is everything. The same rule applies to social media. A clearheadshot of yourself is all that you need. Choose one where you are feeling confident and perhaps smiling. Take it a step further if you really want a polished image, and use a picture of yourself in a business suit or some type of professional attire. If you are going to establish yourself as a leader, you need to play the part.

13) Blog only when you have something to say that is of importance, and that is useful, resourceful, and relevant to others. Why blog otherwise? If you want to rant about the latest meme, or blog about what you had for dinner, do it on a personal blog or message board. This is why I don't blog everyday, or blog about regurgitated new stories. This is not my style and should not be yours. If it's going to be your style, let people know beforehand or create a separate entity for it altogether. It all comes down to quality NOT quantity.

14) Your blog does many things for you, but the number one thing it does is establish authority. Establish yourself as an expert on a particular subject matter, after all this is the reason for blogging. Blog about your expertise, your passions, what you and only you do best. Your audience will find you eventually, and that is who you should be catering to. Focus and be consistent with your blogging. Don't be all across the board. You will learn in time, by trial and error, what works and what doesn't work.

15) Leave the introverted mentality at the door. That's not social media, that's just media, plain old ignorance. Ask for help when needed, be verbal, speak up and ask questions. We all were newbies at some point in time. Educate yourself first and foremost, read, read and read. When blogging always link out to others, credit fact sources when applicable. Make it a practice to link out in every blog post you write, and do it positively. Bloggers succeed only with the help of other bloggers, and the relevant communities they are catering to and participating in.

16) Find the top 25 blogs in your space, and subscribe to their RSS feeds in Google Reader. Consistently be on the lookout for new blogs, and the voices behind them. This also helps with the creative workflow and process. It also gives you linking out opportunities, build your brand awareness and most of all helps build authority. Don't expect recognition right away, and don't get discouraged if no one notices your efforts right away. You must first establish the foundation before you can build on it.

17) Quality content speaks for itself, and is recognized. Your content defines you and the message you are trying to convey. Quality gets noticed above anything else. Let others promote your content and you should only promote your best work. It may take days, weeks or even months to establish a close network of friends. When I mean friends, ones that you have a genuine relationship with.These are not simple quick click followers who you have no intention on having any level of communication with. Your true friends will be the ones promoting your content and helping you get the word out there. The old saying is true, patience overcomes perseverance.

18) The content that you create should be something that people want to share. For the most part, it should be relevant to your networks’ interests. Create newsworthy, thoughtful, intelligent content that has immediate usefulness. Don't expect a home-run all the time, and do not be disappointed if certain posts do not get enough coverage. It's the nature of the beast. It often takes time for things to get picked up.

19) Leave thoughtful and constructive comments on other blogs. This promotes good practices in social media. It also gives you an opportunity for more exposure and additional places for people and fellow bloggers to discover your blog. This can lead into new networking opportunities, and potential new friendships and networking opportunities. The best way to reward a fellow blogger for their hard work is by leaving comments. This will also get you on their radar screen a lot faster. There are no negatives to this, only positives.

20) Never fly blind. You must know where your traffic is coming from. Install analytic software, such as Google Analytics. It’s a good idea to have at least two stats packages installed and running. All analytic software is not created equal. They all have the same purpose, but vary in their reporting and tracking methods. Results will vary to an extent, and comparison of multiple data sources is vital.

21) You have linked out to many bloggers, some are noticing and linking back. But how do you know? The answer is simple, set up Google Alerts to track mentions of your blog. This is a requirement not an option. Blogging software such as Wordpress will track inbound links, but it's not always accurate and lots of inbound links are missed. In addition to alerts, you need to be doing Google Blog searches and Twitter searches. These are the first tools you should be using, but there are plenty more listed here, and they are all free. Wouldn't you hate to miss a moment of recognition? Put yourself in the other blogger shoes. They might get the wrong impression with no acknowledgement back, these things need to be avoided at all costs. You can't please everyone all the time, but at least make the effort to no matter how big or small.

22) Promote others, even more than you promote yourself. Retweet good content, Stumble it, Digg it, share it and so forth. The "others" first and foremost should be your network's content. Everyone else comes after that, plain and simple. Your online network is family and need to be treated as such. Sharing, self promotion is always a two-way street.

23) I'm going against the grain on this one, but it's something I still practice to this day. Ask for link exchanges, the worst that will happen is that you will get declined or you wont get an answer at all. I'm not saying to stick links on your site to every blog out there. Look for quality link exchanges from blogs that focus on your subject matter. The real benefit from this is purely from a search engine perspective. A link from a blog with a higher pagerank could be very beneficial to you, in turn boosting your pagerank in the process. It's also a nice way of showing support and appreciation for a blogger as well.

24) Interaction with your readers is crucial for long term success. Encouraging commenting is very important if you are seeking sustained long term repeat traffic. Ask questions in your post. Ask the readers for additional tips or thoughts on the story subject. Do not require registration. Make commenting easy and not a chore. Make time to reply to comments that require an answer. It's not feasible to reply back to every single comment, but at least put forth the effort.

25) There are two types of bloggers. One way bloggers and two-way bloggers. You need to strive, and pride yourself on becoming a two-way blogger.

26) Establish a Feedburner account. Provide easy visibility for new RSS subscribers, use text links in addition to graphics to promote your RSS feed You can also add an email subscription form on your site for people who do not use RSS. You should also give people the tools to promote your content. Add to your blog and postings promotional tools such as social sharing and bookmark services. Addthis.com is a good starting point. It's a few simple lines of code and your done. You should also take full advantage of Feedburners Feedflare.

Twitter:

27) Establish a Twitter account and learn how to make it beneficial not only for you, but for others. There is no right or wrong way to use Twitter. There is one wrong way, which I will highlight next. Twitter is a powerful tool for listening and more importantly broadcasting. You may not spend countless hours on it, but the time you do spend on it, use it effectively.

28) Do not use Twitter for spamming. This is a perfect example of how NOT to use Twitter. If your intent is to spam and add no value whatsoever, consider going back to the basics, email-spam. Don't waste your time and others with this crap.

29) If you are going to use auto-replies for new followers, do NOT include any self-promotional text and or affiliate marketing links. You wouldn't do this in real life with people you first meet, the same rule applies here. It's a waste of time, it does not work, and it pisses people off. If you are going to use auto-replies, there is nothing wrong with sending a friendly thank you for following note.

30) There is nothing wrong with announcing a new Blog post on Twitter. Do it in a tasteful and respectful manner. If this is all you are going to be using Twitter for, you won't see much results. Contribute to Twitter first before you use it solely for self promotion. A good way of adding value and contributing is re-tweeting your followers tweets. When you come across quality content, promote it to others by broadcasting a link to it on Twitter. You should also practice being resourceful and helpful as much as possible on Twitter.

31) Take full advantage of Summize, Twitters built in search function. This is a great resource for research, and keeping track of who mentions your content. This is the perfect tool for performing blogger ego searches.

You need to be where it counts. Establish and build power passports, profiles.

32) Passports are the social profiles that we create on other social networking sites and platforms. You need to have Omnipresence in social media. Your Facebook, LinkedIn, Twitter and Google profile are all passports. More importantly, they are all sources that generate search engine traffic. It's very important that you maintain a recognizable, uniform presence across all social networks, professional and personal.

33) Consistency needs to be practiced and applied to every area of your involvement in social media. All of your online profiles should share the same information. Make sure to use the same user names. If possible, use the same profile pictures (if applicable), logos and contact info.

33) Be consistent with blog posts. Try to establish and maintain a schedule for posts and stick with it. Be consistent with tagging your images, bookmarks and blog postings. Be consistent with commenting on other blogs, as well as with comments left on your own blog.

34) Stay consistent with the latest trends and technologies. Think about how they can impact or improve your successes online. Things are quickly changing on the Internet. Failure to adapt with the times has consequences.

35) Experiment with new mediums. Try your hand at creating videos, of course this depends on what your objectives are. People love visual aids. if you are selling a product, create a short video about it. Video tutorials, screen casts and so forth are priceless. You could also ask your users for video testimonials. Bandwidth is not an issue for most people nowadays, take full advantage of it when and where you can. Here is an idea, create a short video for your about page on your blog. When you find good videos that are relevant to your subject matter, embed them on your blog posts.

Friends, followers and family, without them you are a rowboat without a paddle.

36) Hopefully friends to you are people you have some level of engagement and conversation with. Friends in social media or for that matter in social networking are not equal to what we classify as friends in real life. Friends in social media are followers who take the next step, which then evolves into some level of general interaction. Friends in time will morph into members of your core network. Choose your friends wisely, this is the army you will need for the battle you are about to embark on. While you have the option to friend people back, it's all about your objectives using social media. If you want a mass audience, then friend everyone who friends you back, but if you have no intention of ever having any level or engagement, then you are just fooling yourself, and all your doing it list building. You need to be receptive with friends who are trying to engage you positively. It's impossible to interact with hundreds or even thousands of friends, but the ones who reach out to you, by commenting on your blog posts, sharing your content, tweeting your content and so forth, you can not neglect.

37) Followers are your audience, always remember that. Without them you are a rowboat without a paddle. Never lose sight of this. As I mentioned before, followers evolve into friends, be cognizant of that fact. Never take them for granted.

38) Family is your core network. Your core network is your power, your network is connections. These are the people that will be there time and time again. They are your support through good and bad times. These are relationships that are built up over time. These are genuine relationships. Never lose sight of this, and do what you can for them at all times when applicable. This goes beyond just sharing or promoting their content. You are only as good as the network you align yourself with, make sense?

39) Always give the little guy a platform and a chance to shine. Your followers, and friends may also run blogs. When the chance presents itself, offer guest postings on your site. Link out to them when possible. You can also leave them recommendations on LinkedIn if you know them well or can vouch for their work ethics. Look for opportunities to expose others in a positive light, no matter how big or small.

40) Whether your goals and objectives in using social media are for professional or personal reasons, the outcome will still be the same. The outcome depends on what you put into it. Be prepared to commit a lot of time, devotion, patience, and understanding. You must crawl before you can walk, it's that simple. Be passionate about your initiatives. Have fun and always show your human side. Contribute and give more than you ask for in return, at least in the very beginning. Do onto others as they do onto you. These best practices will reflect on you, and in the long term will come back tenfold. This is what social media is about, now roll up your sleeves and start laying the foundation.

Image by Ricardo under Creative Commons License.

Read more by Mike Fruchter at MichaelFruchter.com.

Hey Twitter, It's Not Just a Worm, It's an App

By Jesse Stay of Stay N' Alive (Twitter/FriendFeed)

There's no doubt that the worm making its rounds on Twitter is a nuisance and a huge problem for all. The fact of the matter is, somebody has collected your usernames and passwords, and many of your accounts are now Zombies, spamming each friend on your friends list through direct message, turning more unsuspecting accounts into zombies, and spreading like wildfire. Louis has talked about the worm which has surfaced on Twitter, and the urgency of the situation and potential implications for OAuth and security for Microblogging.

I suggested plain text passwords could be to blame - after all, any application out there that collects your usernames and passwords could theoretically use those passwords to start such a worm, in order to gain access to people with similar bank account passwords and more. That would be the fastest way over, say, a single user trying to amass friends to dm. We're already seeing several of those compromised accounts sending iphone-related spam, so it would appear the worm developers could now be monetizing this, through your friends. At the same time, I keep seeing others criticizing the possibility that OAuth could have prevented this. I'd like to share my thoughts why.

Disclaimer

First of all, let me preface this with the fact that I am not a security expert. I have been developing software since I was 10 (I am now 31), and have plenty of real-world experience writing secure software. I've worked in health organizations requiring software to respect privacy around your health data, with e-commerce protecting your money, and I've written APIs. I understand what it takes to keep software safe. I also run my own business in which I also have to protect my users' data. I also understand that nothing's perfect. While security has not been my sole focus, I hope I can at least make some sense of the matter.

First Things First - This is an App

Let's set things straight here. Now, I could be wrong, but all evidence seems to suggest that this "worm" is actually an application, or possibly multiple applications, running on multiple servers around the world (the IP range also suggests that the same developers have targeted YouTube and Bebo in the past). After all, the only other way to log in on behalf of users and DM others would be to screen-scrape Twitter, simulating a user actually logging in via the Twitter.com interface. This is possible, but I would imagine we would see Twitter very quickly implementing some form of Captcha to slow it down. We haven't seen this yet so the most logical conclusion is that someone has written an App somewhere, which is taking advantage of the fact that you can login via plain text usernames and passwords. The same application is taking those usernames and passwords, and programmatically logging in on behalf of each compromised user and direct messaging their friends to collect more usernames and passwords.

Currently, the Twitter API makes it completely possible for anyone with your username and password to log in on your behalf, programmatically. Essentially, Twitter has given developers the key, and all keys open up the same lock. The only way to shut this down would be to kill the lock, which would shut off all developers. This is why the topic of OAuth continues to be brought up - to start off, OAuth forces any developer to use a protected key or token in order to log in on behalf of the user. The developer never has the user's username or password. The user himself keeps their own keys to Twitter without having to give a copy of those keys to developers.

It's not that simple though.

Why They're Saying OAuth Wouldn't Have Fixed the Problem

Assuming Twitter had implemented OAuth, let's assume no developer has your username or password and your information now feels secure. There is still nothing stopping those users from using those tokens to log in on your behalf. Essentially, while the developer couldn't screen scrape your data to log you in through Twitter with such a key, they could still use the API, just as these current Phishers are probably doing, to continue to send DMs and messages on your behalf. An OAuth token is just like another username and password essentially, intended just for API use.

The other criticism they're giving OAuth is that it still doesn't stop the Phishing. When the end-user authenticates through an OAuth-enabled website, they are taken back to a page on the originating site that, if they aren't logged in, asks them to log in, and that site in turn returns them back to the third party site with an OAuth token that can be used for access. Nice and simple, right? Well, the problem (which I've only seen theorized, but it is definitely possible) is that any third-party developer could create an app that redirects the user back to a page that just looks like the originating site (like Twitter.com, for instance), and pretends the user isn't logged in. The site could then collect the username and passwords of unsuspecting users, just as the current phishing scheme is doing now. The potential is still there to collect usernames and passwords, just as before.

The Advantage People Keep Forgetting

Let's ignore the last paragraph and just focus on the one before it. Even though an application can easily login on behalf of the user via the API, with OAuth, a site like Twitter now has full control over each and every application that runs on the API. OAuth has controls which allow API providers like Twitter to cut off any application using the API. So, assuming Twitter sets up some sort of manual approval process similar to Facebook's (I suggested this to Ev and Biz in the interview I attended with Scoble last year (end of the article), and they said they were working on this) to weed out the sketchy applications, it becomes much easier to just cut off the offending application. They now have record of the exact application sending these DMs, and can cut it off immediately. Currently, they're stuck chasing IP addresses, and trying to block various IP ranges, which are tough to block and easy to switch.

Back to the Problem

So, let's assume Twitter had implemented OAuth. We now have two possible scenarios: Scenario 1, said Phisher signs up to have an app on the API (or buys an app like Twply), and sends out DMs on behalf of users. (Note that the Phisher couldn't start as an individual and collect usernames and passwords in the manner this Phisher did in the current scenario because they couldn't send plain-text usernames and passwords via the API) The Phisher gets users' friends to login via OAuth, he collects the tokens to send out DMs on behalf of other users. Twitter's in-house alarms go off of such activity. Twitter shuts down said Phisher in a matter of minutes, and only a few people even see the worm.

Scenario 2 is a little more difficult, but less motivational for a Phisher on a site like Twitter. In this scenario, a Phisher creates a fake 3rd party app, accumulates a lot of followers somehow, and gets users to somehow think they are going to Twitter to login, and they collect the users plain-text usernames and passwords. The said Phisher can't do anything through the API, because it doesn't allow plain-text usernames and passwords. All they can do with it is screen-scrape Twitter, login on behalf of the user, and go about it that way. They also have to accumulate a decent sized following.

First, let's face it, there's not a ton of information that's not already public a Phisher can gather on such a site as Twitter, other than their username and password, which could also be used on other sites like banking sites. I really think most of these Phishers are more interested in spamming you, trying to make a quick buck off the unsuspecting sending spam to their friends (like the iPhone example above) - selling the data to spammers I'm certain is big bucks (at least $1,200, according to the sale of Twtply). Second, Twitter could easily implement a captcha system in such a case, and by that means they could at least slow down the Phisher or spammer. At that point, if the Phisher or Spammer is still diligent enough to get through, they have a much more controlled system, and they can then play the IP blocking game. Let's face it though - this isn't a banking site, usernames and passwords only go for a meager $1,200 from what we know, so most spammers ought to give up at that point. It's much less of a problem, and much easier of a problem to deal with than what Twitter is seeing now.

The Purpose of Security is to Make it Harder

As I said earlier, no security plan is a perfect plan, but the harder it is for a perpetrator to get through a system, the more secure that system is. Currently, there is no barrier between Twitter and those than can potentially misuse your usernames and passwords, other than you. As I said earlier, Twitter has only one lock for each user, and each developer you share your information with has the same key to that lock as you do.

However, despite the continued risk for phishing OAuth poses, as Lachlan Hardy suggests at the end of his piece here, it is still a step in the right direction, and I think would have prevented this particular worm. OAuth would have given Twitter the capability to revoke the keys of the offending phishers, enabling them to shut the worm down when it happened. After all, this isn't just a worm, it's an app, using the API, like any other developer, but in this case to spread malicious websites. I want to suggest that Twitter stop skirting around this issue, stop pretending OAuth wouldn't have solved the problem, and just implement something, quick.

Read more by Jesse Stay at Stay N' Alive.