Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This is something I've thought about a while and have not found any articles or blog posts about. There are articles for users on how to protect themselves, but that is not what I want to know about. I do not understand why Twitter accounts are attacked so regularly. I also want to know when I am building an API what I should do to ensure that accounts cannot be compromised.

I am thinking the most common ways that accounts are compromised are...

  1. Guessing the password.
  2. Apps connected via OAuth
  3. Get the encrypted password and run a password cracker on it

In the first scenario it would have to be run many API calls which would easily be detected if a single account is being hacked, especially from the same IP or same pool of IPs. After 100 failed attempts in a short period it is obvious and the API should start returning error codes to those API calls for that account. The downside here is that anyone could get someone else's account locked out. In high school we did this on the computers in the lab before class to lock each other out as a prank a couple of times. After a few failed attempts there was a 15 minute cool down before any attempt to log it would succeed. The teacher had to unlock the accounts so we could start class. If this is how accounts are compromised I wonder what could be done short of going to two-factor authentication. Perhaps requiring the account to be unlocked with a captcha challenge and valid password would do the job.

The second scenario is a tough one. If a third party app has bad security and their system is compromised they could use the OAuth access to spam your followers on Twitter. If this is done then Twitter should be able to tell the user which connected app was responsible and if enough accounts are compromised that way that app should simply be flagged and blocked until that app has fixed the problem. I doubt this has been the problem.

The third scenario seems unlikely because an attacker would have to get the encrypted password and run a password cracker on it. I'd protected the encrypted password by not placing it in the same database as everything else. I would also strictly restrict who has access to this database.

Based on these scenarios my guess is that most accounts are compromised by the first scenario.

Are these scenarios how accounts are being compromised with Twitter? What could be done in terms of the API developer to prevent accounts from being compromised?

share|improve this question

closed as off-topic by Synetech, Siim K, gronostaj, Tog, Ƭᴇcʜιᴇ007 Jan 5 at 16:33

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question is not about computer hardware or software, within the scope defined in the help center." – Synetech, Siim K, gronostaj, Tog
If this question can be reworded to fit the rules in the help center, please edit the question.

One scenario I did not include is Phishing to get a user's password. I suppose that might be a common way to compromise accounts. –  Brennan Stehling Jan 5 at 4:51
I'd like to point out that only one of these options (Apps connected via OAuth) are specific to twitter. The other two have to do with passwords everywhere and not twitter specifically. –  Chipperyman Jan 5 at 5:00
The third scenario - stolen database - happend a lot to huge companies in the past.. –  Bonsi Scott Jan 5 at 8:24
"Hello, this is Oliver from Twitter. We're doing a regular maintenance check up on all accounts. Could you please tell me your password so that I can log into your account?" Yeah, sure. It's password. –  Oliver Salzburg Jan 5 at 11:08
Hi Oliver, my password is SuperSecurePassword. :) –  Brennan Stehling Jan 5 at 20:24

1 Answer 1

You may perhaps wish to read this article about the 10,000 most common passwords. I would like to draw your attention to these statements:

79% have a password from the top 500 passwords

91% have a password from the top 1000 passwords

share|improve this answer
That is sort of what I was expecting, but one way to defeat that is for Twitter (and other services) to require strong passwords. Mine are always long with a mix of unusual characters. I thought Twitter did not allow simple passwords. –  Brennan Stehling Jan 5 at 20:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.