Interesting Twitter Hashbang Bug
Did you know that you can to link to a specific Tweet on Twitter? The URL looks like this: https://twitter.com/#!/edent/status/197967209459499008
Pretty obviously, that's the user's name and the ID of their tweet. Simple, right?
Not really, click on that link and you'll see this:
That's my name in the URL bar - but the Number 10 Press Office's tweet on the page.
What's Going On?
Have I retweeted that status? Nope! Am I a 1337 h4x0r who has hacked Number 10? No sir! Is the screenshot a fake? Nuh-uh. Check the link yourself.
It's actually a curious bug / feature of Twitter. Each tweet you send has a unique ID. So there can only be one tweet with the ID 197967209459499008. And that ID will always belong to @Number10press.
The username part in the URL is redundant. It seems that it is not used except to give information to the user / search engines. It can be safely omitted or manipulated.
Malicious Use?
It strikes me that there is a slim chance of malicious use.
One could create a fake account - say Number1Opress (where the 0 has been replaced with a capital O). Make it tweet something ridiculous, then share a URL which has the real Number10press in the URL. Minor embarrassment is probably the worst consequence.
It's an interesting usability / security nexus. The username is placed in the URL to make it easier or more useful for users - but it is ignored by the back end system. As it's part of the hated hashbang syntax, I wonder if it could be simply be rewritten if there's a mismatch?
Given that would still be possible if the user was redirected to the real url for that tweet, I think it would be better (and fairly easy?) for Twitter to give a 404 if the name in the url didn't match the account the tweet was sent from?
Breton Slivka says:
For example, the programming site, StackOverflow disregards the text added to the end of the URL.
http://stackoverflow.com/users/42106/this-is-a-load-of-text-that-does-not-do-anything
The problem here is that to a user the URL indicates the identity of the @author and they may not notice that the @author is slightly different when they view the tweet itself which has (theoretical, at least) security and privacy implications. Particularly if exploited in such a way as to encourage a user to follow a link (or open an image or other content) that they might not follow if they did not believe it had come from a trusted user.
Perhaps in the future you coud have fun with that by associating certain content with people's Twitter account names. Not sure what affect it would have though. 🙂