How to turn your Twitter favorites into twitter testimonials — and then display them on your Wordpress blog.

The act of fishing, according to Texas State Rep. Aaron Pena, can be described as “slow, methodical and patient.” The act of phishing, on the other hand, can be described as methodical, patient and unscrupulous.

The first time I saw the word phishing, I did not immediately think of phreaking (hacking a telephone system). I thought it was a clever “respelling” of the word “fishing” since the two verbs share a common theme: to seek to obtain something indirectly or by artifice.

Phishing was first described in a paper in 1987 and first mentioned online in 1996 in an AmericaOnline newsgroup. Fourteen years later, phishing has spread from the relatively closed garden of AOL instant messaging to semi-closed gardens like Facebook and wide-open spaces like email and Twitter. Almost all online definitions of phishing describe it as an email-based scheme.

The language of the phisher seems relatively unchanged. On AOL in the 1990s, phishers would directly ask poential victims to “verify your account” or “confirm billing information.” This week, they are indirectly asking us for our Twitter login credentials. The phisher provides a link to login page that looks like Twitter, unless we examine the URL visible in the address bar. The unsuspecting click “sign in” and the phisher then uses this newly-acquired access to send the phishing link, as a direct message, to everyone who is following us.

Clearly, this system is methodical. It is, after all, governed by the if-else logic of computer code. It is patient: the phisher is content with a very small click-through rate. This is, after all, how real-world viruses propagate; everyone who is exposed to a cold or flu virus does not get sick. And it is unscrupulous: the phisher poses as us to our (initially at least) unsuspecting friends.

There is less malice in the current Twitter scam than in the Facebook “I’m stranded and need money” phising example. The Twitter attack does not seek to directly separate you from your money and possessions. But many people use the same login credentials for multiple accounts. That same patient computer code which now has your Twitter ID and password could be used to try to open other accounts: email, online commerce, banking.

A Plea For Virtual Safety
Here are some steps to secure your online identity:

• Just say no. Be mindful before clicking on links in Tweets, Facebook status updates and email. Think before clicking. Use a browser with built-in safety features. For example, Chrome, Camino and Internet Explorer warned me about the current phishing attack on Twitter; however, neither Firefox nor Safari provided a warning.
• Avoid creating new accounts. When a website asks you to create an account, opt instead to login with Facebook, Twitter, OpenID, Disquus, TypePad. In other words, use a preexisting account. If the originating website only uses FacebookConnect, consider sending them a note asking for choice.
• Segregate login profiles. The login profile for your online banking should be substantially more secure than one for reading a news site or for commenting on your favorite blog or for editing a Wikipedia entry. I don’t believe that it is reasonable to say “create a new password for every account” … because I know you won’t. It is reasonable to suggest mindfulness.
• Develop a password strategy. After you’ve thought about the types of profiles in terms of risk and frequency of access, develop a password strategy. For non-monetary accounts like most news sites, Wikipedia and your favorite blog, pick a password that is easy to remember. What is the worst that could happen if someone figures out your password to one of these accounts? They’re not going to get your mailing address or access to your bank account. In this case, memorable is probably more important than “strong.”
• Minimize duplicate instances of the same password when risk goes up. When the answer to “What is the worst that could happen?” includes access to personal or banking information, don’t use the same password for every account. As the risk goes up, make the password more secure. Whine loudly when a vendor (like Verizon) will not let you create a secure password on their system.
• Email passwords should be strong. In a perfect world, we’d use one email account for all of our financial transactions and a different account for corresponding with friends and yet third account for mailing lists and such. The more that you co-mingle the way you use your email account the greater the risk if the account should get hacked. The greater the risk, the more secure the password. Remember that email is often used as the way to reset account passwords!
• Completely segregate online banking. Your online banking password should not be used on any other account.

Now excuse me, please, while I go practice a bit of what I’m preaching.

01. Example of a Twitter Direct Message Phishing Attack. Question: Why Hasn

02-Chrome, Camino and Internet Explorer Detected Phishing

03-Safari and Firefox (Mac) Went Straight To False Login Screen

04-Remember To Look At URLs! In This Case, The URL Is A Dead Give-Away

:: This post first appeared at wiredpen
:: Follow Kathy on Twitter!
:: Follow UWTwitterbook on Twitter!

Almost two weeks ago, I urged early recipients of the Twitter retweet link to be cautious with its use, because most third party clients seemed unable to display these retweets.

Today I’m repeating the caution, and it’s not only because of spotty third party client implementation. It’s also because these new retweets don’t become “real time” in the Twitter.com timeline for tweets made by anyone you are already following.

High Level Summary
One of the advantages (to the original author) of RTs is that each becomes a new tweet, a new instance. This increases the chance that someone will “see” the original tweet.

Think of a retweet as “bumping” an item “up” in time. But that’s not how the new Twitter.com interface works. On low volume accounts, this isn’t a big issue. But on moderate– to high-volume accounts (measured by number followed), it is. Here’s why.

Twitter doesn’t “bump” the old tweet — it merely changes the “retweeted by” count. So if you read your Tweets on the Twitter.com site and missed a tweet the first time around, you’ll miss it each-and-every time it’s retweeted … because it will remain in “history,” far below the fold.

The third party clients that have implemented the new retweet feature, however, appear to be treating the retweet like a new instance. In other words, they are treating them like the “old” retweets. The problem: some popular third party clients haven’t yet implemented the feature.

1. Twitter.com — The new RT feature does not “bump” tweets, ie, these new retweets are not “real time” for tweets made by anyone you are already following. I think this is a fatal flaw.
2. TweetDeck — both desktop and iPhone application — is still not displaying retweets sent via the “retweet link” in the Twitter web interface.
3. Seesmic Desktop is still not displaying retweets sent via the “retweet link” in the Twitter web interface.
4. Brizzly, a beta web interface for managing your Twitter and Facebook accounts, is displaying the new retweets
5. Tweetelator and Tweetie2 (iphone apps) are still displaying the new retweets

Methodology
In order to test how well clients render the new retweets, I “bracketed” the new retweet with an old-fashioned copy-and-paste one — either immediately before or immediately after using the Twitter retweet link. I sent retweets from all three of my accounts: @kegill, @kegill_uw, @kathygill. Each account follows the other two; this is great for testing!

1. Twitter.com
Even though I do not follow Howard Rheingold from my @kegill_uw account, the retweet showed up in that timeline on Twitter.com, with his avatar. Note that the timestamp relates to when Howard tweeted, not when I retweeted. This is a major change and is a little jarring if you’re looking at tweets before and after it that were sent seconds ago. Twitter should add the time stamp after “you”. This time-stamp business has other ramifications that I will explain momentarily.

On both of my low-volume accounts, the Twitter.com interface shows both original and test retweets in real-time. But on my high volume account, @kegill, not a single test tweet (there were four) was displayed in real-time. Why not?

For example, the @kathygill timeline shows multiple retweets — both the “test” retweets as well as tweets retweeted by the account and by other accounts. This is a very very low volume account (follows 18 mostly low-volume accounts).

Next, see an example of the @kegill timeline, with the @eMarketer test retweet showing at the top. In this instance, the test retweet was made after the new retweet, as you can see from the prior screen capture.

The original tweet, with the eMarketer avatar, did not appear in my @kegill real-time timeline on Twitter.com, although I retweeted it, using the new feature, from both @kathygill and @kegill_uw. I went 5 minutes back in time looking for it, even though the tweets were sent seconds apart.

This is a big problem with the new feature.

Because @kegill already follows @eMarketer, that tweet had already been displayed in my timeline. The new retweet doesn’t “bump” the tweet in time, it merely changes the “how many people RTed” data on the original tweet. This means retweets aren’t “real-time” for anyone who is already following the account you retweet. I think this is a fatal flaw.

However, if someone that I do not follow is retweeted by someone that I do follow, that retweet shows up in real-time, even when it’s really old (in this case, 48 hours old):

One of the advantages of the new feature, however, is public metrics. Twitter added a “Retweets” link beneath favorites (right hand navigation). It’s a handy way to see how many people retweet the things you do (or your tweets) as well as who they are.

2 and 3. TweetDeck and Seesmic

I made several attempts to see if TweetDeck would display a tweet that was retweeted via the new web interface link. Not a single one was displayed on TweetDeck, whether iPhone app or desktop app. I do have the latest version of TweetDeck on both the desktop and iPhone.

Here are sample screenshots — they show the “test” retweet (copy-and-paste). I guess you’ll have to take my word for it when I saw the original did not show on any screen.

In this screenshot from the desktop, the “test” retweet was sent immediately after the original. Howard Rheingold’s tweet, without my “test” label, did not show up in TweetDeck.

The same is true for TweetDeck iPhone. In this instance, the “test” retweet was sent immediately prior to the original.

Seesmic Desktop does not display the new retweets, either. What follows are three screen captures — one from Twitter.com, showing a retweet; one from Seesmic, showing that it is missing; and one from Tweetdeck, showing that it’s missing.

4. Brizzly
Brizzly is in beta (just ask if you’d like an invitation) and is doing a great job of rendering new retweets.

4. iPhone application Tweetelator
There’s no change since my last report; Tweetelator is still displaying the new retweets. Moreover, it marks them with a little flag:

Conclusion
First, the new retweet link is designed to make it easier for people to retweet. However, there’s nothing to stop old-fashioned copy-and-paste if you’re using the Twitter.com web interface. Keep an eye on how your third-party clients implement this feature — will they retain their current “RT” process or adopt the new? My vote is for the former.

Second, one advantage of using the retweet link is the Retweets summary link, just below Favorites in the right-hand navigation. This feature makes public statistics about each retweet — just how many people retweeted and who they are. I’m not convinced this advantage outweighs the limitations of retweets not being real-time, however, for moderate– to high-volume accounts.

Therefore, until Twitter displays retweets in real-time in the timeline (something that I doubt they will do) and until all third party clients display retweets (hopefully like Tweetelator and Brizzly, in real-time), I again urge caution if you are using Twitter for branding or influence. Not only is there an issue with everyone being able to see these retweets (think Tweetdeck) but there is the issue of their possibly not being real-time on the Twitter.com interface.

This post first appeared at WiredPen

For those of you who are in the Twitter “retweet” beta test, I have a word of advice: proceed cautiously.

Here’s why. Currently, retweets that are executed via the Twitter web “retweet link” are visible to your followers who are using theweb interface to read your tweets but are not visible to popular third party clients.

Let me say that a different way: popular third party applications are currently not displaying RTs executed via the Twitter web interface “retweet” link. In other words, these retweets are MIA in a follower’s timeline in popular third-party clients. The exception: Tweetie2.

This may be a “cart before the horse” problem. In other words, third party applications may not have had a chance to integrate the new API. Or it may be that Twitter privileged Tweetie2 developers. I don’t know.

But if most of your followers read your tweets using third party desktop clients, this “bug” could have a serious impact on your personal retweet rate in the short-term. Experiment wisely. And mindfully.

The Story In Pictures

People who are part of the beta test will see a familiar-looking “alert” on their Twitter home page:

Sending A Retweet With The New Feature

Twitter has made it very easy to send a retweet via the web interface. This may be an attempt to make the web interface a more pleasant experience for people who follow a lot of accounts. Certainly, the ability to easily retweet has been a mainstay of third-party Twitter clients.

(1) Read your tweets via the web interface. When you find a tweet that seems interesting enough to share with your followers, mouse-over. You’ll see the “retweet” link to the right of the familiar “reply” link.

(2) After you retweet, this is what the tweet looks like from your home page: it bears the avatar of the original account (instead of your avatar) and includes information about who retweeted it as a tagline. Thus, this new feature might make it easier to discover interesting people to follow.

versus

(3) On your profile page, the visual difference starts with an icon instead of initials (RT). Again, the Twitter ID that shows is the original author, not the person who retweeted. Note that there is an “undo” option. I haven’t tested it to see how long this “delete” feature takes.

(4) In addition, Twitter tells you how many other people have retweeted a specific tweet. That’s an incentive, of sorts, to use the new feature.

Receiving A Retweet With The New Feature

If you are in the beta test, when you receive a retweet from someone else in the beta-test, you’ll see an alert when you are reading your tweets from the web. But if you aren’t reading them from the web, you won’t see those retweets in Seesmic, Tweetdeck or TwitBirdPro.

(1) If you are in the beta test, Twitter gives you a heads-up to explain why you are seeing a new avatar in your timeline. This is a smart move for the part of the Twitter community that follows a small-ish number of accounts; for them, the new avatar might be visually jarring.

(2) If you are not in the beta test, your retweets look exactly like they always have, in the web interface. (This is how my “new retweet” tweet looks in my kegill_uw account. Yes, I follow myself there.)

(3) However, the problem comes for your followers who do not use the web to read your Tweets. The Twitter-powered retweet simply falls into a black hole.

First, see the Barbara Clements retweet in context (the tweets before and after it, web interface). Then look at Seemsic, from the desktop, and Tweetdeck and TwitBirdPro, from the iPhone. Notice that the Barbara Clements retweet is MIA in all three instances.

(4) One exception appears to be Tweetie2. My @romensko retweet from the new interface does show up in my kegill_uw account in Tweetie2, just like it did on the web interface.

So there you have it.

Be judicious in your use of the new retweet link if you think most of your followers read your tweets from a third party client, unless that client is Tweetie2. I’ll update this post as I test more clients.

Update: 10.30 pm Saturday
Here is the “base” tweet we’re looking for:

And how that retweet “looks” at the kegill_uw account, in context:

(1) No Go: Twitscoop:

(2) No Go: Twitterrific:

(3) No Go: TwitBirdPro
There was an update for this application at the iTunes store, but it didn’t enable this functionality.

This post first appeared at WiredPen

One of the organizations that we are profiling in the book, Kodak, has published a social media tips handout (pdf — tip @MackCollier). Kodak Vice President Jeffrey Hayzlett writes:

Why do I take the time to use social media like Twitter and Facebook? Because in today’s media landscape, it’s vitally important to be where our customers are. Kodak has always embraced this marketing philosophy, and today that means being active in social media.

The 16 page handout covers myths, provides tips, and includes information on Facebook, YouTube and Twitter. It also includes the company’s social media policy. Kodak has a great “where we are” page on the website: http://kodak.com/go/followus (long live shorter, human-readable URLs!).