TweetSG – SMS to Update

What is Tweleted?
Tweleted allows you to recover Twitter messages — tweets — after they’ve been deleted.

http://tweleted.com/

Thanks to @inrsoul, I came to learn about TweetStats, a really cool tool to compile your tweeting stats.

Check out http://tweetstats.com !

Before you start bitching about Tweeting via SMS with passwords, read:

http://www.h-online.com/security/Twitter-closes-SMS-spoofing-hole-Updated–/news/112786

In short, using “Sender ID” (aka FROM) as a user identification is too weak because certain bulk-SMS services allow anyone to change FROM field to any number. Effectively, the attacker assumes the identity of the victim by simply changing the FROM number to the victim’s.

There are no other information in the SMS message that proves that the sender is really the legit user to the system before accepting the commands.

Having password to authenticate yourself is better than nothing since it is the most widely known form of authentication to the general public. Even if Twitter were to introduce the concept of “user application key”, I doubt it will be ever used by users because most of them will be wondering “Why the heck we need to do that for?”.

For 3rd party services that store Twitter credentials insecurely that are nice targets for break-ins, good luck & have fun.