Should I provide lost credentials to users via a direct message on Twitter?

Question

Is it better (more convenient or secure) to provide users with a lost username or password via direct message on Twitter rather than via email?

Answer 1

I really don't want sites throwing my username and password over Twitter.

No thank you!

Answer 2

It is as secure as sending it over email. If you generate a new password and then send it to the user via dm only the user can read it. And yes the user can access twitter in an unsecure way over an not encrypted connection. But you can't assure that somebody uses an encrypted connection to access his mail either.

In fact it could be more secure because you know that only twitter admins can intercept the message and no admin reading the mails from his users

Answer 3

You don't supply lost passwords at all (mostly because you can't, because if you're doing it right you don't store passwords in plain text anyway).

You facilitate a reset-feature that allows the user to, with the help of for example a secret question or simply an activation link via email, change their password.

Answer 4

Security aside, there's also the significant flaw that you can't send password reset information, password reminders, or anything else to your user via direct message if he's not following you on twitter. Unless your site is itself a twitter client, then the odds are pretty good that a substantial fraction of your potential users won't be particularly interested in following you and are likely to resent being told that they must follow you (or at least follow/change password/unfollow) if they want to use your site.

Update: I forgot to mention... If you want to tie your user authentication functionality to twitter, then why not just use Twitter OAuth instead of maintaining your own password store at all? It works quite well (barring the fail whale), is very quick and easy for the users, and doesn't place any requirements on who they follow or don't follow.

Answer 5

Secure your passwords and don't send anything by email or twitter. Lookup MD5 and other algorithm to do this.

Wikipedia says:

In cryptography, MD5 (Message-Digest algorithm 5) is a widely used cryptographic hash function with a 128-bit hash value. As an Internet standard (RFC 1321), MD5 has been employed in a wide variety of security applications, and is also commonly used to check the integrity of files.

I hate it when I see a website storing my password without encryption... and if the website started sending me my password via twitter I'd break something.

Answer 6

Start by reading this post: What is the best “forgot my password” method?
This will get you started in the right direction.

Answer 7

Instead of sending passwords verbatim over any insecure channel, send a nonce instead. Such as: a one-time URL the user clicks, verifies personal info, then is forced to choose a new password.

This way, if the message is intercepted, no damage can be done without also hacking the personal questions.

Answer 8

I want my password sent by UPS, FedEx, or USPS when I forget them.

Punish the user.

Bad user.

Answer 9

Enough people have pointed out that you shouldn't be storing passwords in plain text anyway, so I won't repeat that.

But if you're sending a one-time-use password-reset link as a Twitter DM, then you have to take into account that the user might receive that message on their mobile phone.

Then you'll have to make sure whatever that link points to is set up to display correctly on mobile phone web browsers.

Then you'll wish you just stuck with email.