Prevent People From Losing Control of Their Profiles.

By Thomas Baekdal | Monday, March 01, 2010 | Section: tips

We hear about it all the time, people's social profiles are taking over by hackers. It is fairly simply done. Find a way to get people's username and password, login, change their login credentials, and voila. The attacker now has complete control over peoples profiles, and there is nothing they can do about it.

Just a few days ago, the musician Jason Mraz's Twitter account was taken over, and because the attacker changed his password, he could not do anything to stop them - apart from trying to contact Twitter and persuade them that this really was his account, and that someone else was in control of it.

As he wrote (on Facebook): "**IMPORTANT** someone has hacked into Jason's twitter account. Don't believe anything that is tweeted until we have access back into the account!"

Then today, United Airlines lost their Twitter account.

But here is the thing. It is amazingly simple for app developers to prevent this sort of thing. That is. You cannot prevent people from losing their username and password, but you can prevent that in doing so, they also lose control of their profile.

Here is what you do:

When anyone tries to change either the username, password or email address, send an email to the existing email address with the following message.

This way, it would be impossible for an attacker to take over your account, because you would always be able to change it back to you. Even if an attacker changed your password, email, or username, it could all be reversed by a simple following the link. And because this link would always be sent to the email on file before it was changed, you would always be in control.

It is really that simple - one email, with an "undo" link.

...something that every web app should implement by default.

Comments

blog comments powered by Disqus

There is always more...

After one month, I do like the iPad »

I have been using the iPad for about a month, thanks to the great help of Joshua Hayes, who helped me import it. While people in the US and parts of Europe have been able to buy it for a while, Apple continues to treat us Vikings here in Scandinavia as second class citizens. Not only isn't it available, but Apple has as yet not even confirmed a release date.


Incorrect Social Referrer Statistics »

If you are using Google analytics (or another analytics service), you have a referrer graph similar to the one below. There is just one problem, it's wrong.


Recharge your iPhone with Music »

Everyone who owns either an iPod Touch or an iPhone have experienced that the battery power sometimes increases when playing music. The effect is actually easily reproduced.


Tip: Forget the Box »

Here is a quick tip. If you are making a web application (or website), don't put it into a box, or add a border. The application is already in the most dominant box of all - the browser window. We don't need two...


Windows 7 - on a MacBook Pro »

Windows 7 has arrived (at least for MSDN members), and it looks... well... it looks... ah... it looks blue.


Share on:

Share via Facebook

Share on Buzz

Submit to Digg

Post to Stumbleupon

Send via email