Recent events in Twitterland have brought into question how easily we trust any website that simply asks for our password, while informing us for no reason do they maintain or record it.  We simply shrug and willingly give it away.  So where is the breakdown?

The first one is in the difference between a new site needing access to account information that is not possible through the public feeds or profiles.  So to compensate, we get asked for our password.  In the fray of getting a ranking number, you the user, missed an entirely serious issue.  Not only were you sending your credentials to a non SSL login area, it was clear they were using the login for something far more than stated in the About pages.  I prefer the sites that offer a string that you provide (like FriendFeed) that is unique to you, but not your password.  You then enter this API information and the site goes about their business.  You can then change your API key if required to protect your account while never giving up your password.  Looking through EverythingTwitter this evening, I realized that quite a lot of the web based add-on tools (see the category there) do not ask for a password.  They have found a way to access enough information via API calls that the site in question today cannot for some reason (according to the site owner)?

Second is the amount of times we enter our password in general.  Let's presume that this site was collecting user passwords.  How many of you avid readers of mine use the same password on each site?  Almost all of you have 2-3 password strings.  You have the uber-secret string used for banking, credit and other personal items.  You have the super-secret used for controlling your blog and hosting accounts, etc.  Then you have the less secure you fire up everywhere else for any other new social service you wish to test.  The idea is limiting your exposure right?  But how log would it take you to go through each service and change/update to a new password if you get compromised?  How many of you have generated a string of text that makes each site unique?  I have, and it is now ingrained in the way I do business.  Sounds like a new posting.

So the new sites need to fully develop the solutions based on API work and refuse to ask for passwords, or we need to step ack and refuse to provide them.  I was surprised at the sheer number of people that not only attempted to use Twitterank today, but Twitterawesomeness.  An identical twin that appears to have actually copied your password no matter what the page source says.