Hacker News Reader

Comment by jalada | Hacker News Reader

Appreciate any feedback. We're only just getting started, there's a long way to go :)

The service seems counter intuitive. You advertise "The safe way to manage your company’s Twitter accounts." yet using the service would mean giving access to a third party. We all know that security is hard and you're creating online password manager - if it will be popular, it will gain unwanted attention.

Sure, you are using an access token and not a password for the accounts, but that's not explicitly said anywhere. I suggest you improve the trustworthiness of Echelon on the landing page.

The landing page mentions that you don't have to share passwords, which is what makes it inherently securer than...well...sharing passwords. Agreed that perhaps it could be clearer that by using access tokens, access can be revoked at any time via Twitter directly which removes the risk (compared to people stealing passwords).

See, I'm bit confused here. I understood it so, that as a user of Echelon, as I wouldn't have to give the Twitter account password to colleagues. But what about to Echelon itself? How can I be sure that the Echelon won't be compromised and all hell wouldn't break loose? Does the account have one Echelon app authorized which then works as a middleman to the users?

Since only the tokens are stored on Echelon's server, any compromise might do some damage (tweets, bio change, etc), but you will not lose the account's password.

So that's a pretty good tradeoff if you ask me.

They don't use https anywhere, not even on the oauth redirect back with the token in the header... isn't that.. bad?

How much you want to bet they are doing 0 encryption of the tokens they are storing on their servers.

Consider changing the sign in button to a contrasting colour (green?) - I'd wager you'll get more people clicking on it :-)

Well, you said any so: if I cancel Twitter sign-in on the homepage I get "The page you were looking for doesn't exist.".

Considering the image on the homepage is just a sketch, is the app actually built or not?

Thanks, I'll sort that.

Yes, it is. I agree that we probably need to add some real screenshots too :)

I've long thought there was a market for a product like this, but I figured it would be hard to get people to use it if they have to ditch their preferred twitter clients to post (if that assumption is correct).

We have some plans to address this so people can continue to use the clients they love.

Reply on news.ycombinator.com