RUN! Close down your browser, turn off your computer, do not pass “Go”, do not collect $200!

Why such panic? Because, if you ever see a pop-up similar to that above, it may not be as innocuous as the one created by the guys over at Dave Naylor’s blog. In fact, someone with half an ounce of tech savvy could

…make a Twitter ‘application’ and start sending tweets with it. Using the simple instructions below, it can be arranged so that if another Twitter user so much as sees one of these tweets – and they are logged in to Twitter – their account could be taken over.

Yikes!

Twitter confirmed that the exploit had been fixed, but apparently no one over at Twitter thought to contact Naylor’s team to learn exactly how they exploited the web interface, because even after the fix, they replicated it.

If you’re using a third-party application to send and read Tweets, you should be safe. Other advice includes:

• If you’re not logged in to Twitter, there’s no opportunity to steal your details or impersonate you, however malicious code could still send you to other websites or otherwise annoy you, so it doesn’t completely fix the problem.
• Unfollow anyone you don’t know or don’t trust that could be exploiting this. Who’s to say they’re not already stealing your details? If you don’t see their tweets they can’t harm you.

Let’s hope that Twitter gets a real fix in place soon.

Comments

Mashable’s Pete Cashmore tells of the new process

The feature has been a long time coming, and many celebrities will jump on the opportunity to prove their legitimacy. It’ll also solve the entrenched problem of celebrity impersonations, which are confusing for users and unwelcome by those being impersonated. Businesses, however, will have to wait: the feature has not been rolled out to corporate entities yet.

Cashmore also says, “The process to become verified appears to be limited to power meaning that celebrities, musicians, athletes, actors, public officials and public agencies on the service can now display a “verified account” button on their Twitter pages.” Well, one thing is certainly a relief here. I wouldn’t want any public officials being portrayed as lying or bending the truth to fit into 140 characters at a clip. That would certainly be seen as unusual for that group (my apologies as to my level of sarcasm, when it comes to politics it’s hard not to be at least a little cynical).

To see if you meet the standard of requiring account verification you can visit the verified account page for more information. There will probably be confusion and wondering whether someone is ‘verification worthy’ (remember Elaine’s ‘sponge-worthiness’ measurement from Seinfeld?) and what does it mean if the verification badge is absent?

With this feature, you can easily see which accounts we know are ‘real’ and authentic. That means we’ve been in contact with the person or entity the account is representing and verified that it is approved. (This does not mean we have verified who, exactly, is writing the tweets.)

This also does not mean that accounts without the ‘Verified Account’ badge are fake. The vast majority of accounts on the system are not impersonators, and we don’t have the ability to check 100% of them. For now, we’ve only verified a handful of accounts to help with cases of mistaken identity or impersonation.

Twitter left the door open for expansion of the service but also covered their bases just in case it doesn’t scale easily

We may verify more accounts in the future, but because of the cost and time required, we’re only testing this feature with a small set of folks for the time being. As the test progresses we may be able to expand this test to more accounts over the next several months.

And for those who are of the belief that they are truly important and suffer from impersonation issues on Twitter but don’t fit the initial verification profile there’s this

Although we’re not verifying all accounts, we’ll try to work with you if your account is constantly competing with parody or impersonation accounts. Fill out this feedback form so that we know your situation.

Twitter’s ‘Good Tweetkeeping Seal of Approval” has been launched. Will you be the first on your block to get a badge?

Comments

Some of the coverage of this event portrays LaRussa as a guy with no sense of humor.

So what’s the fuss all about? Apparently the individual tweeting as Tony La Russa (@tonylarussa was removed after the lawsuit was filed) made statements that the real Tony didn’t appreciate. So he’s suing Twitter and the causes of action include trademark infringement, trademark dilution, cybersquatting, misappropriation of name and likeness, invasion of privacy, and intentional misrepresentation.

Two of the fake tweets in particular is actually very out of bounds. They read:

Lost 2 out of 3 but made it out of Chicago without one drunk driving incident or dead pitcher……I’d call that an I-55 series

Drinking a cold Zima and wishing f*$#@^ Hancock was alive, I bet he could’ve gotten Jack Wilson out.

Not so funny if you are the family of Darryl Kile who died while in Chicago with the team in 2002 of coronary disease or Josh Hancock who was killed while driving under the influence in 2007. LaRussa himself was arrested for a DWI offense in 2007.

I am not suggesting that we require good taste from people on the Internet. That’s like asking to move a beach full of sand one grain at a time. In this case, however, there may not have even been an issue if the imposter (who is a coward by the way) hadn’t been so dismissive of serious matters which bring in other innocent parties like families that want to put these things behind them. Maybe this is a rant but this crossed a line in my opinion.

So the legal side of this? You can see a description of the suit at the Citizen Media Law Project. What the courts determine will be interesting and there is little if any precedence to look to since this is not a domain name squatting case. The WSJ recently talked to this matter.

So what’s your take? Have you had any issues along these lines? What actions have you taken? Will this open the flood gates for cases, real or imagined, against Twitter and other social media players?

Comments

Now it seems that the “power players” of Twitter are being targeted—yet it’s not directly at them. Rather, it’s using them instead.

This latest trick sees users that have a certain authority on Twitter—i.e., thousands of followers—be the lucky target of a fake account with their details. Their image and name is used to trick unsuspecting users into thinking it’s the real person. Normally it’s a play on the person’s name—underscores, dashes, numbers, etc.

While these fakes are easy to spot if you know of the person in question, it’s a different matter if you’re either a new Twitter user or someone who doesn’t know Lee Odden, Chris Brogan or Andy Beal. These are the types of users that the scammers are targeting.

It’s also a major pain for the user whose name is used in this way—their reputation can be tarnished, for one thing. So what’s the answer?

• As a Twitter user, it may be an idea to mention in your profile that this is your only Twitter account—all others are fake.
• As soon as you see a spam or obviously fake account, report it to Twitter by sending a message to their spam team.
• Block the fake account—don’t let their numbers grow any further.

While imitation is the sincerest form of flattery, downright identity theft is illegal. You can report suspected spammers to Twitter, but perhaps Twitter should start identifying these fake accounts to the targeted people and bring charges against them? It wouldn’t hurt their own reputation…

Comments