We Are Not Safe Trusting Startups but Do We Have Other Options?

Yesterday we had a peculiar situation around Twitterank, a new Twitter tool that requires you to enter your Twitter login and password and calculates some number that probably means something but it is hard to figure out exactly what it means. It is well known that social media crowd tends to enjoy all types of rankings, ratings, and top lists so there was no surprise in watching how eager people were to check their performance on Twitter with the new application.

But then Oliver Marks on ZDNet suggested that Twitterank could probably be nothing but a huge scam intended to steal passwords from as many Twitter users as possible and teach Twitter team they need to enhance security to avoid scams with login credentials in the future.

This story obviously makes one thing clear about safety and security level that we enjoy when checking the countless new startups that we try out daily. There are various services that work like addons to some larger services and require us to grant them access to our other accounts. The most popular operations are related to importing contacts from social networks like Facebook, LinkedIn, and Twitter.

In this respect SocialMinder came to my mind as another example of pretty dubious activity of a startup that we grant access to our Gmail accounts (and I know that there are people who use Gmail to manage our financial accounts like PayPal or Moneybookers). In fact, SocialMinder sounds like quite an interesting tool intended to manage your email and social networking contacts better. But the guys obviously have problems with attracting new users in some legitimate ways as they chose to spam people from our contact lists to get them join the service seemingly recommended by friends. I have not signed up myself since I quickly realized it was some sort of a scam and decided to do a quick search on it before doing anything myself but from what I’ve read on blogs of its victims the application offers all new users to send invitations to 15 of their contacts to be able to try out the fully functional version of the application. And this was exactly what many people did - reportedly spamming all the contacts from the address book as well.

There was another very similar example - Yaari - that also sent invitations to all the contacts after users eagerly granted it access to their web mail accounts. This one was a simple social network looking for some viral growth with the help of its users - without telling them they were spamming all their friends as well. And of course the only thing it actually received was users’ revolt.

I have just realized that over the last two years of writing about web applications here on Profy I have provided my login credentials to Twitter, Gmail, Yahoo Mail, LinkedIn, Facebook, etc. to tons of applications that I only heard of for the first time in my life 5 minutes before granting this information.

As it often happens, someone in the blogosphere discovers an application (usually after getting a pitch from a developer) and recommends it to everyone because it is cool/interesting/unique/unusual. And everyone else rushes to check the application out - eagerly granting our emails, logins, passwords (that many of us often use on multiple websites) when asked without even thinking twice.

But have you ever thought about it from this point of view: how often do we see new applications launched by people we have known for some time at least and grown to trust? My suspicion is that you will agree that most often we see web startups launched by total strangers - yet we are very willing to share our information with them without at least trying to understand how trustworthy these people and their products are.

But the problem is that in the majority of cases we actually have no other options but do what the application developer asks us to do - or not use the service at all. At the same time the application developer usually offers us the only thing he can do based on the limitations of the services he needs to communicate with - and he would be happy to offer us some safer way to do that if only he could. I myself tend to believe that people in general are good but I also agree with Allen Stern that we should try to be reasonable dealing with such requests to provide sensitive information. But unfortunately for now I don’t see any safety measures that a startup could offer to prove they can be trusted yet I hope that there will be something invented in the near future after a few more discussions like this one.

Image credit