Simon Willison’s Weblog

The Anatomy Of The Twitter Attack. Long-winded explanation of the recent Twitter break-in, but you can scroll to the bottom for a numbered list summary. The attacker first broke in to a Twitter employee’s personal Gmail account by “recovering” it against an expired Hotmail account (which the attacker could hence register themselves). They gained access to more passwords by searching for e-mails from badly implemented sites that send you your password in the clear.

# 20th July 2009, 12:55 am / gmail, hotmail, passwords, security, twitter

Weak Password Brings “Happiness” to Twitter Hacker. The full story on the Twitter admin account hack. I bet there are a LOT of web applications out there that don’t track and rate-limit failed password attempts.

# 7th January 2009, 12:04 pm / hacking, passwords, security, twitter

Antipatterns for sale. Twply collected over 800 Twitter usernames and passwords (OAuth can’t arrive soon enough) and was promptly auctioned off on SitePoint to the highest bidder.

# 2nd January 2009, 10:48 am / jeremy-keith, oauth, passwordantipattern, passwords, security, sitepoint, twitter