This is something I've thought about a while and have not found any articles or blog posts about. There are articles for users on how to protect themselves, but that is not what I want to know about. I do not understand why Twitter accounts are attacked so regularly. I also want to know when I am building an API what I should do to ensure that accounts cannot be compromised.
I am thinking the most common ways that accounts are compromised are...
- Guessing the password.
- Apps connected via OAuth
- Get the encrypted password and run a password cracker on it
In the first scenario it would have to be run many API calls which would easily be detected if a single account is being hacked, especially from the same IP or same pool of IPs. After 100 failed attempts in a short period it is obvious and the API should start returning error codes to those API calls for that account. The downside here is that anyone could get someone else's account locked out. In high school we did this on the computers in the lab before class to lock each other out as a prank a couple of times. After a few failed attempts there was a 15 minute cool down before any attempt to log it would succeed. The teacher had to unlock the accounts so we could start class. If this is how accounts are compromised I wonder what could be done short of going to two-factor authentication. Perhaps requiring the account to be unlocked with a captcha challenge and valid password would do the job.
The second scenario is a tough one. If a third party app has bad security and their system is compromised they could use the OAuth access to spam your followers on Twitter. If this is done then Twitter should be able to tell the user which connected app was responsible and if enough accounts are compromised that way that app should simply be flagged and blocked until that app has fixed the problem. I doubt this has been the problem.
The third scenario seems unlikely because an attacker would have to get the encrypted password and run a password cracker on it. I'd protected the encrypted password by not placing it in the same database as everything else. I would also strictly restrict who has access to this database.
Based on these scenarios my guess is that most accounts are compromised by the first scenario.
Are these scenarios how accounts are being compromised with Twitter? What could be done in terms of the API developer to prevent accounts from being compromised?