Simon Willison’s Weblog

Antipatterns for sale. Twply collected over 800 Twitter usernames and passwords (OAuth can’t arrive soon enough) and was promptly auctioned off on SitePoint to the highest bidder.

# 2nd January 2009, 10:48 am / jeremy-keith, oauth, passwordantipattern, passwords, security, sitepoint, twitter

Now You Can Sign Into Friend Connect Sites With Your Twitter ID. Great. Now even Google is asking me for my Twitter password. Slow clap. How’s that Twitter OAuth beta coming along?

# 15th December 2008, 5:20 pm / google, oauth, passwordantipattern, security, twitter

Google wants your Hotmail, Yahoo and AOL contacts. And they’re using the password anti-pattern to get them! Despite both Yahoo! and Hotmail (and Google themselves; not sure about AOL) offering a safe, OAuth-style API for retrieving contacts without asking for a password. This HAS to be a communications failure somewhere within Google. Big internet companies stand to lose the most from widespread abuse of the anti-pattern, because they’re the ones most likely to be targetted by phishers. Shameful.

# 15th September 2008, 10:39 am / aol, ffs, google, hotmail, oauth, passwordantipattern, phishing, security, shameful, yahoo

Facebook Security Advice: Never Ever Enter Your Passwords On Another Site, Unless We Ask You To. Nice to see TechCrunch highlighting the hypocrisy of Facebook advising their users to never enter their Facebook credentials on another site, then asking them for their webmail provider password so they can scrape their address book.

# 9th August 2008, 10:18 am / facebook, hypocrisy, passwordantipattern, passwords, security, techcrunch

Yahoo! Address Book API Delivered. At last, now there’s no excuse to ask your users for their Yahoo! username and password just so you can scrape their address book.

# 4th June 2008, 6:03 pm / passwordantipattern, phishing, security, yahoo

Find Your Friends. Flickr have added a characteristically classy friend import feature, pulling from Gmail, Yahoo! and Hotmail address books without any unhygienic password sharing. It’s a crying shame that the Yahoo! contacts API they are using isn’t available outside the company.

# 1st April 2008, 1:01 am / flickr, gmail, hotmail, passwordantipattern, portablesocialnetworks, yahoo