Taking over an account

Someone started a Twitter account with the sole purpose of mocking me. It took me quite a while to find out who it was. Since practically everyone enjoys a good joke at my expense, the suspect list was quite long. But finally, I received information from a good Samaritan who did some investigating that was out of my reach.

I confronted the individual, a friend of mine, and asked him to turn over the account that was tarnishing my reputation (many people thought I was behind the account, leading them to believe I was pretentious and egotistical). After a few hours of instant messaging and agreeing to some terms (such as anonymity), he gave me access to the account. Upon logging in, I immediately changed the password, logged out, and logged in with the new password to make sure it took.

A day or two later, the user popped up on my radar again by mentioning my name in a tweet.

How did he get access to the account?

My first thought: I’m an Idiot! I forgot to change the email address in the account settings! If my friend went through the password reset steps, he could easily regain control of the account. I tried logging in with the password I had recently set, and it worked. I changed the email address and changed the password again. Then I contacted my friend about it, admitting my idiocy regarding the email settings. He said he hadn’t thought to go through the “Forgot password?” steps.

Then how did he get back in?!

He told me he had left his browser window open. The morning after yielding control of the account, he went back to the browser and it still worked!

This is where it gets SERIOUS

Let’s imagine, hypothetically, that you give your password to a 3rd party application. If the application’s owner uses that password once and saves the session cookie, they can store the session cookie and re-create it at any time in the future even if you change your password (There are even browser plug-ins that allow you to read and write cookies).

This means they can get back into your account whenever they want, indefinitely. They can post tweets, read your DMs, follow other users on your behalf, etc.

What’s worse, they can lock YOU out of YOUR ACCOUNT!

If you type in your password every time you go to Twitter.com (even if your browser “remembers” it), an attacker can take complete control over your account. The “remember me” checkbox will give you the same permanent access to your account that your attacker enjoys. So how can they take over your account? You can change your email address without typing your password! If an attacker is in your account, changing your password won’t stop them from kicking you out. They can change the email to their own address, log out, and request a password reset from Twitter. They send an email to you and you can click the link to reset it.

How to stay safe

As far as I know, there is nothing you can do to prevent this from happening to you, aside from never giving anyone or any application your password.

Twitter needs to use a smarter session cookie that is in some way linked to the user’s password or have another way of killing other sessions if you log out. Twitter should also consider using per-user API keys for users to give to 3rd party applications, instead of authenticating with your password.

The Six Stages of Debugging

1. That can’t happen.
2. That doesn’t happen on my machine.
3. That shouldn’t happen.
4. Why is that happening?
5. Oh, I see.
6. How did that ever work?

This year’s event will include the usual broad range of entrepreneurial topics, but will have a touch of social media. The speaker line-up is among the best Phoenix, AZ has seen in one place, especially in the tech entrepreneurship realm.

It’s going to be absolutely amazing.

In this economy, you might want to learn what is happening in our local banking market. It’s something you need to know if you are in business.

And there will also be an announcement from Microsoft that will benefit anyone with a software startup (under 3 years old) or a new project.

Businesses and entrepreneurs looking for funding, talent, real estate plays for the future, green initiatives or innovative ideas will find them all at the Third Annual Arizona Entrepreneurship conference November 19 at the Buttes Resort in Tempe, Arizona The day-long event will connect participants with some of the most interesting and active entrepreneurs and investors across the U.S. Last year’s event was standing room only, with this year’s event expected to draw even larger audiences.

Keynote speakers include a collection of heavyweights sharing their in-the-trenches experiences in building, funding and selling their companies.

Keynote Speakers:

• AllanKaplan, Co-Founder of Limelight Networks and Director of Clearview Capital Partners
• Matt Mullenweg, Founding Developer of Wordpress
• Gary Vaynerchuk, Founder of WinleLibrary.com
• Bill Reichert, Managing Director, Garage Technology Ventures
• Howard Lindzon, Partner in Knight’s Bridge Capital Partners and Founder of Wallstrip

Full conference will include:
- The State of Startup Financing
- Creating a Product that Can Sell
- Local Successes
- Lessons Learned
- State of the Blogosphere
- Sustainability Initiatives
- State of Funding in Arizona
- Social Media Best Practices

Conference details:
Location: November 19, 2008
7:30 am – 7:00 pm
at The Buttes Resort (2000 Westcourt Way, Tempe, AZ)

Registration ($150) includes lunch and a continental breakfast: http://www.azentrepreneurship.com

For many people, wealth and fame are tangential to their goals. They generally don’t cite them as the desired end result, but they are kept as lingering expectations. That is reward-driven success.

Even expecting a thank you or a pat on the back can make you reward-driven. A self-proclaimed altruist who is upset when he is not thanked is not an altruist at all.

If you are doing what you do for money, fame, or even a thank you, get out of the game now.

I occasionally catch myself disappointed when my efforts to help go un-thanked, or worse, unnoticed. I remind myself it was the impact I was striving for and not the thank you.

You need to engage and embrace the community you have and let it grow organically. Getting thousands of people to give you a sliver of their attention and none of their support does you little to no good.

You need to focus on blowing people away, turning casual observers into rabid supporters.

That is how you build a valuable community.

Before, it was organized by Brent Spore (@iboughtamac) and his wife Michelle (@mspore). This year, they have been working with over a dozen volunteers to make sure the event scales — they’re expecting more speakers, more attendees, and the event will span two days.

PodCamp AZ 2008
November 1 & 2
Phoenix, AZ
(register now!)

I volunteered to give two presentations (one on each day).

First, I will talk about the future of Internet video and interactive interfaces. Many content producers use a traditional broadcast model for their content, which is very unidirectional. The Internet allows for two-way communication, which opens the door for many different ways of producing a show.

The other presentation will be about turning online connections into “in real life” (IRL) connections. Some people have concerns that “social” media is making people less social in real life. It can if that’s how you use social media. However, social media can be used as a tool to help you be more social.

Instead of saying my best practice first, and then tag people, I’m going to do it backwards.

Tag:
I am going to ‘tag’ EVERYONE in the Phoenix area. This Thursday at Social Media Club Phoenix, the topic will be social media best practices and everyone who wants to participate can share theirs.

My social media best practice:
Come to the Social Media Club meeting on September 11th and I’ll tell you!

Startup Weekend recruits a highly motivated group of developers, business managers, startup enthusiasts, marketing gurus, graphic artists and more to a 54 hour event that builds communities, companies and projects.

It’s that simple. A large group of people get together and work through a weekend to start a company. It’s bazaar, exciting, and fantastic.

I think they have held at least two dozen of these events in various cities around the country. Finally, Phoenix will get its turn! It will be held October 17-19 in Chandler, AZ, and tickets are $40 (to help cover food, drinks, etc).

Here are all the links you need:
StartupWeekend.com main site
Phoenix.StartupWeekend.com
Idea gathering/voting

If you would like to assist in planning or offer to sponsor part of the event, let me know! Along with Gregg Drennan, Justin Crossman, Derek Neighbors, Sean Tierney, Steven Shaffer, and others, I will be helping organize Startup Weekend Phoenix!

If I don’t talk to anyone about these ideas or post them online, it seems as if the thoughts have gone to waste. Generally, the ideas are specific to one company and do me little or no good keeping secret. The purpose of writing about the ideas would not be to get through to the target company, but to share with others my thought process and possibly provide inspiration for others who may have similar opportunities.

I received a coupon in the mail from Blockbuster a while back, and it got me thinking. The coupon was part of a promotion they were running for an upcoming motion picture award event (Oscar, Emmy, or Academy). It was pretty obvious they blasted this bulk mailer out to just about everyone. This type of bulk mailing seems to be a shotgun approach to get people into the stores. Aren’t there more efficient ways of doing it? I go to Blockbuster a couple of times per year, and that coupon didn’t seem to be enough to inspire me enough to increase my patronage.

There are, however, people who rent movies regularly and thus would be more likely to participate in a promotion like that. Realizing this difference in behavior between me and a movie aficionado, I thought about different ways of increasing activity in each group. The mailer I received was likely to be more effective on the active movie aficionado group than on the group I fit in.

The key to grouping people by behavior is right down my alley. You’re dealing with abundant data (millions of customers’ rental habits) and identifying trends. I would imagine a rental behavior graph would look something like this:

Expressed in that graph is a common philosophy recently promoted as the “long tail.” I am going to blindly speculate that out of 50 million households renting from Blockbuster, less than 1 million rent an average of two movies per week (100+ movie rentals per year). A larger segment is likely to rent an average of two movies per month (25 movie rentals per year). The largest segment, or the long tail, probably rents zero to ten movies per year.

In a mailer targeted on the upper two percentile (the 100+ crowd), if it results in one additional movie rental, it will increase sales with 2% of your customer base by 1%. Now, if you target the sixty to eighty percent of customers who rent less than ten movies per year and focus on increasing their rentals by one per year, you will increase sales with 60-80% of your customer base by an average of 50%.

One additional rental per customer in the lower sixty percentile is much more valuable than one additional rental per customer in the upper two percentile. It may take a more significant discount to get those less active customers to go out of their way to rent from Blockbuster, but there are two very important factors at play.

First, the most obvious, if you discount something enough to eliminate 90% of the profit and sell it to 30 million people (lower sixty percentile), you are still making more money than you would if you reduce 10% of the profit and sell it to 1 million people (upper two percentile). Second, if you double someone’s yearly activity, you are taking a step toward forming a habit (like weekly or monthly “movie night”).

Beyond targeting segments of people with bulk mailers, Blockbuster should be able to react to behavior changes. There is no reason why they shouldn’t notice and react when a customer who rents movies every month misses a month. Why not drop them a coupon in the mail to make sure they haven’t forgotten about you?

There are tools and people available these days for any company to perform intensely detailed behavioral analytics on their customers. Reacting to a specific customer’s behavior is traditionally some a small, agile business owner would do. Today, large corporations have the ability to be agile on a per-customer basis. They will need to perfect the art before their competitors do.

And again, I already know I think too much!

Biray Alsac
Reduce MySpace Between Waist & Thighs So Wiki Live Longer
http://panelpicker.sxsw.com/ideas/view/877
When NY Times covered blogger Om Malik’s heart attack, it was a wake-up call to Web 2.0 community about our lifestyle. Is being ‘plugged in’ destroying our health? We beg to differ. Consider using the internet for fitness! This panel will debate which next generation technologies are helpful in ‘exercising the web.’

James Archer
Brand Tribes: The Art of Creating a Community
http://panelpicker.sxsw.com/ideas/view/887
Learn how to promote your product or service using the concept of “brand tribes,” which smashes the old “Us vs. Theme” marketing mentality and replaces it with a consumer-driven branding framework. Learn how to create a cult following with specific, real-world examples and hands-on exercises.

James Archer
Out of the Bedroom and Into the Boardroom
http://panelpicker.sxsw.com/ideas/view/1342
You’ve enjoyed the home office life, but it’s time for your web design business to grow up and get serious. Discover the top ten truths that successful businesses have learned the hard way, including ideas on office space, employees, business partners, cash flow, and staying sane.

Francine Hardaway
Fire Your PR Firm: Brand it Yourself
http://panelpicker.sxsw.com/ideas/view/1259
Social Media Club interim board members will give advice and anecdotes about how PR and branding have changed because of social media and how, as an entrepreneur, you sre empowered. You can now market your own product or company better than any PR firm. And you should. This is for technical people, to teach them the DIY of social media as a branding tool. You would be surprised how many engineers don’t know this.

Derek Neighbors
Collaborative Development Environments
http://panelpicker.sxsw.com/ideas/view/885
The interactive industry has been exploring online/virutal social networks over the past few years, but are just now starting to delve into physical collaborative development environments. We will look at social group dynamics in a number of arenas including open studio space for architects, collaborative class room models, green dev houses, collaboration based musical acts and co-working interactive facilities. We will be inspecting how existing collaboration models can be used to help improve the interactive industry.

Brian Shaler
Distributed Computing: Let the Client do the Work
http://panelpicker.sxsw.com/ideas/view/1068
Traffic surges on the Internet can topple newly popular web services; it’s a common side-effect of success called “Growing Pains.” Web services can provide more functionality while consuming fewer server resources by distributing the workload to end-users’ computers using desktop applications and browser plug-ins.

Brian Shaler
Future of Video on the Internet: Interactive Experiences
http://panelpicker.sxsw.com/ideas/view/1065
Networks are getting faster, servers are getting more powerful, software is getting more advanced, digital video production hardware is getting more affordable. In 5-10 years, how will end-users be experiencing video content? The key is interactivity.

Pamela Slim
From Blog to Book Deal: How-To
http://panelpicker.sxsw.com/ideas/view/913
Is traditional publishing dead? Apparently not, as many bloggers are landing book deals that extend and enhance their online work. Learn the ins and outs from bloggers who have done it including how to shape a coherent book from tons of posts and involve your readers in your writing.

Joshua Strebel
FAIL As If Your Life Depends On It
http://panelpicker.sxsw.com/ideas/view/1754
It does. Last year we bankrupted your company on the whim of a Unicorn, this year we show you why failing in your startup/life/project is the first step in truly succeeding. FAIL early- FAIL often. Your success is measured as the sum of recoveries from near disaster.

Joshua Strebel
Fake It ‘Til You Make It
http://panelpicker.sxsw.com/ideas/view/950
You are a nobody - Become a somebody. A strong personal brand can create business opportunities, boost your income, and even make you interweb pseudo-famous. But where do you start? Learn how to cultivate a powerful personal brand online and offline and leverage it for your professional success.

Sally Strebel
5 Common Misperceptions of Technological Creativity
http://panelpicker.sxsw.com/ideas/view/1000
Drinking the creation koolaid can sometimes be deceiving. It’s like trying to acclimate your taste buds to dog crap. 5 successful panelists share with you the ways to get results rather than reaching into a risky over populated grab bag.

Sally Strebel
Climbing the Corporate Ladder in a Mini Skirt
http://panelpicker.sxsw.com/ideas/view/999
Powerful tech women share their secrets regarding kicking ass, moving up the ladder, dealing with jerks, and helping other girls reach the top.

Steve Swedler
How Social Networks Are Killing the Revolution
http://panelpicker.sxsw.com/ideas/view/1557
Social networking sites today do as much for real world action as paint on the walls does for the structural integrity of your home. Come discuss how we are creating a false majority-view mentality and how to overcome this to achieve large scale change in the world.

Sean Tierney
Miracle Grow for Communities: What Makes Them Thrive?
http://panelpicker.sxsw.com/ideas/view/1161
Why do some groups thrive while others sputter and die? We’ll explore the preconditions and ingredients that contribute to an engaged community, whether online or in person. You’ll learn core strategies and guerilla tactics to turn your anemic group into a flourishing community.