Thoughts on Twitterank
As most twitter users know by now, there was a huge rush today to use a new tool called twitterank. Twitterank asks users to input their twitter user ID and password in exchange for a “twitterank” that seems to fall somewhere between 0 and 200 — the higher the number, the better your twitterank is.
The service caught on with lightening speed in the early afternoon with users purportedly hitting the site at a rate of more than one per second, according to the site’s developer. Doing a twitter search on “twitterank” confirms that the site had huge, huge traffic today. (And continues at a pace tonight.)
The fact that twitterank asks users for their password, the viral nature of its popularity and the downright sketchiness of its design led some in the “upper ranks” of the blogosphere to conclude that the tool is a scam built to hijack people’s twitter accounts. You can read the first “twitterank as phishing scam” reports here and here. However, this narrative was quickly addressed by twitterank’s developer and allies and the site appears, at this point, to be legitimate. (Chris Baskind’s FreindFeed account has a particuarly interesting discussion from someone claiming to know the developer.)
So, what to make of twitterank? My hunch, based on the evidence presented thus far, is that it is not a phishing scam, or any kind of scam, but is rather just a inocuous, slightly silly app. that gives people thirty seconds of downtime at work — certainly there’s no harm in that. Personally, I won’t be getting my twitterank, because — and I mean no offense to the developer — I’m not 100 percent sure the site is legitimate and I don’t want to take the risk of handing over my password. Also, it’s just not something I’m into — I really don’t care where I fall on the twitter pile. That’s not why I use the service.
That said, twitterank has my asking some questions tonight:
Why did so many users flock to twitterank?
This was a classic herd mentality, driven by the interconnectedness of the twitter community. If you had Twihrl open around lunchtime, you could actually see it happening as user after user posted, “My twitterank is…” These users were all following each other and as one, two, three and four people they “knew” went out and used the service they had to as well. Confronted with what looked like a sketchy site, they dove in anyway — most likely against their better judgement. Why did they do someting so risky? I think twtitterer @socialmedium said it best:
well now Im annoyed because I hate all those dumb lists and because I saw trusted friends do it I thought, well shoot, let’s try #twitterank
Why doesn’t twitter have an API that uses authentication other than your password?
I know nothing about programming or APIs — barely enough to even ask the question — but it seems like a better API could be the best outcome of the whole twitterank kerfuffle. Clearly, as twitter hits the mainstream this will be needed to maintain trust and, frankly, functionality. Think about what’s happening right now as potentially thousands of users debate and/or start switching their twitter passwords because they may or may not have fallen victim to a phishing scam. (Again, I think its likely not).
Now multiply that times a userbase the size of Facebook or MySpace — and throw in bad mainstream press for good measure. All of a sudden, you have a holy shit storm on your hands. If you’re going to open up (and grow up) make sure you do it in a way that protects your users.
Why are people still using twitterank despite reports that it might be a scam?
This is still the herd mentality working it’s way through the system. Right now, more people are hearing about twitterank than hearing about the controversy. As news that it might not be legit spreads, the herd will start moving the other way and you’ll have a wave of people changing their passwords. (This is already starting.)
But I also think you have a situation where people really trust the community. The developer of twitterank is a member of the community and community members are the ones spreading the word about the tool, so it must be safe. Certainly no one in the community would hurt us?
This is simply a dangerous fallacy. Anyone in the twitter community, or any online/offline community, could be posing as someone they aren’t (see, @therealalgore). Their intent for doing so could be fantasy, benality, or maliciousness. Maybe they just want to pretend to be Al Gore, or maybe they want to steal your password and hope it’s also the password to your online banking service. You simply don’t know.
Technorati Tags: twitter, twitterank, scams, phishing, security, web 2.0, social networks, identity
comments
Leave a Reply