Would you fall for this Twitter phishing attack?


Journalist Dave Lee pointed out a disturbing new spear-phishing attack on Twitter. The phony account looks for people who are Tweeting their dissatisfaction with Lloyds Bank - one of the largest and oldest banks in the UK - and sends them messages urging them to log in to a fraudulent site. The tweets have some realistic touches - such as ending with "^LY" to signal the initials of who is using the account. As you can see, in some cases, customers interact with the account believing it to…

Continue reading →

Web Based OAuth Is A Security Nightmare For Apps


Twitter have just released Periscope for Android. I'll do a full review of it later (tl;dr it's Qik with worse resolution) - but for now, I want to focus on the sign up process. You can only sign in with Twitter. That's fine, it's a Twitter product. So I pressed the sign-in button and this is the screen I saw. Is that the Twitter mobile website embedded into the app or is it a phishing page? I've no way of knowing! I can't see the URL bar - for all I know, this could be an elaborate…

Continue reading →

Using Twitter To Predict The #GE2015 Outcome


Here's a very silly idea. Can we use the number of followers each candidate has to predict who will win the election? No, probably not - but let's give it a try anyway, eh? Hypothesis Support on Twitter - as measured by the number of followers - is a reasonable predictor of electoral success. It is likely that the incumbent MP will have a large number of followers - having been in the public eye for five years and (possibly) being on Twitter that long. It is also likely that MPs with…

Continue reading →

This is what a graph of 8,000 fake Twitter accounts looks like


Recently I've been plagued with Tweets saying that I'm "trending in London." As flattering as that is, it's not true. There appears to be a network of Twitter bots which are randomly repeating other people's tweets, ripping off avatars and bios, and generally causing a nuisance. Looking at the users' Twitter name, I don't think it's unreasonable to think that "ekip_uhokoqeq" and "utadaqusoxeh" are randomly generated sequence of characters. And, without wishing to judge, that photo…

Continue reading →

Working With The Twitter Videos API


Screenshot from Twitter. 2015-02-18T09:01:37.000Z. katie (@katiemoffat). A dull video of my cat to test twitter videos http://t.co/cGazAn7H3E

Twitter now allows people to upload videos directly to the micro-blogging platform. It's an attempt to bypass 3rd party sites like YouTube (owned by Google) and Instagram (owned by Facebook). In an uncharacteristic display of openness, Twitter's API allows developers to get direct access to video. This is a quick blog post to explain how you get access, and what you can do with the information. I presuppose that you're already familiar with the Twitter API and know how to make basic calls. …

Continue reading →

Working With Twitter's Embedded Videos


Twitter has just launched embedded videos in Tweets. How can we, as app designers, present them to our users? So, what options do we have? First of all, let's take a look at what the Twitter API provides. Send a signed request to : https://api.twitter.com/1.1/statuses/show/560070183650213889.json In return, we get these entities : "entities": { "hashtags": [], "symbols": [], "user_mentions": [], "urls": [], "media": [ { "id": 560070131976392700, …

Continue reading →

How To Stop Twitter Auto Linking URLs


The Twitter logo.

Whenever you send a Tweet with a URL, Twitter automatically replaces the URL with a "t.co" link. This means that long links only count for 23 characters against Twitter's 140 character limit. Mostly, that's great - but sometimes it's not. Inspired by this StackOverflow question, I decided to see if it was possible to write a URL in such a way that Twitter wouldn't auto-link it. Here's what I found Terence Eden is on Mastodon@edentTrying out URL…

Continue reading →

Writing A "Choose Your Own Adventure" Story On Twitter


I've spent the last few days writing a Choose Your Own Adventure (CYOA) game on Twitter. This blog post briefly discusses how I did it - and what pitfalls I discovered when creating it. But, first, if you want to play.... Terence Eden is on Mastodon@edentYou should probably be asleep.I've created a "Choose You Own Adventure" on Twitter.Start here ➡ @wnd_goPleasant dreams.❤️ 6,416💬 429🔁 022:50 - Mon 12 January 2015 Background I'm by no means the first person to attempt running a CYOA on Twit…

Continue reading →

Why Does Twitter Think Facebook is Swedish?


I've nothing against the Swedes. Lovely people. Sweden is the third-largest country in the European Union by area. But I'm not from there. Neither, as far as I am aware, is Facebook. But Twitter seems to think so. When I share a link to Twitter on Facebook, this (sometimes) happens. And sometimes, I get this delightfully mangled Unicode atrocity! So, what's going on? When Facebook wants to display a link, its servers send a quick web request to the URL that the user has typed into the…

Continue reading →

Introducing @1st_Folio_Scans - Shakespeare's First Folio on Twitter


A pixelated Shakespeare.

As part of the Shakespeare Hackday I attended a few weeks ago, we discussed some creative uses of social media. Could we find people tweeting rhyming couplets from the sonnets, for example? I decided, in the limited time available, to create something much simpler. Because the Bodleian Library's scans of the First Folio are under a generous Creative Commons license, it's possible to share the images freely. And quite right too! I decided to place the archive onto Twitter. This account -…

Continue reading →

2FA Best Practice - Disable Autocomplete


Just a short usability / security post. Hopefully, you're all using Two-Factor Authentication on your important sites. As well as a username and password, you've also got to enter a one-time code. Usually it is generated by an app, or sent to you via SMS. Each code can only be used once - which makes it all the more curious that, after a few logins, Twitter's website looks like this: Now, is there any serious security concern? Well... probably not. Another user of a shared computer could …

Continue reading →

Please Stop Retweeting Without Verifying


If you've been on Twitter for any length of time, you'll have seen dozens of plaintive requests like this. The same happens with missing people, lost dogs, and urgent political causes. Yes, it can be a little annoying to see the same thing again and again - but it's all for a good cause, right? Hmmm... I'm not so sure. The act of retweeting something important is often called "boosting the signal." In this case, the "signal" is the worthy cause, the "noise" is the trivial information…

Continue reading →