Our liability as Twitter app developers

Our app used to ask for Twitter write permission in order to provide "follow" buttons. It was infuriating: we only wanted to be able to follow/unfollow for people (since our site used Twitter's social graph rather than rolling our own) but in order to do so we had to ask for full write permissions, which caused people to freak out and assume we wanted to tweet on their behalf or make changes to their profile.

Contrast with Facebook which has a much better implementation of finely grained permissions where you can opt to only ask for the permissions your application needed.

In the end, we switched to asking for read-only permissions for most users and let them upgrade to read-write the first time they wanted to perform a Twitter-write operation. This was a hassle from an engineering point of view but did completely eliminate complains about us asking for too much access: http://lanyrd.com/blog/2012/twitter-read-only/

We eventually moved to our own social graph, which eliminated the need to update Twitter's graph from our interface entirely.

I had to look up who Carl Icahn is (http://en.wikipedia.org/wiki/Carl_Icahn); he's a large-scale investor which is why the quoted tweet about plans to invest further in Apple caused Apple's stock to become more valuable.

It's a good thing I only ask for read access, not write. Write access is getting pretty useless as people have started to ignore people's tweets since there are so much noise.

I wonder when we will stop speaking in hyperbole about stock price changes.

"In April of this year crackers got hold of the Associated Press Twitter account and wiped an estimated $135Bn off the S&P 500 Index by tweeting that explosions at the White House had injured president Obama."

And the stock market rebounded and then some over the coming weeks, reaching new recent highs in May and June... So the effect lasted... a couple of hours?

When people talk about stock market value being "wiped out", they neglect to say that the market fully recovered later that afternoon, or that the market is higher today than it was back then. If you can't acknowledge that stock prices change every second, and that dips or rises are often temporary moments that affect very few shareholders of that company, then the phrase "billions of dollars was wiped out" is just meaningless hyperbole.

One of the biggest problems with Twitter security is the aspect of revocation of app access in the event of, say, a compromised password.

In cases like that, you need some kind of panic button to eliminate all threats, instead of having to go through every single app and delete their access to be safe.

While theoretically true, I think for most accounts the risk is fairly small: I'm sure it's hard to come up with something to tweet from my account that moves any stock exchange even a penny.

I wonder: if you had access to any Twitter account, what's the most damaging thing you could tweet? Are there any things that could put someone's life in mortal danger?

How about a IP- and/or MAC adress as an extra layer of security? On a sidenote: If this makes App's that wishes to post on my behalf disappear I wouldn't mind.

Not sure why this is something that is particularly the worry of developers. Such havoc can be wreaked through simple phishing at the user-level. Even at major organizations, two-factor or OAuth authentication may not be the standard, meaning that a market-changing Tweet is just one well-crafted email away. That seems like by far the easiest attack vector for a hacker.