Yes, yes, a million times, yes. It's stupid to give any service any credentials except those created specifically for that service. (This dictum includes the c

Yes, yes, a million times, yes. It's stupid to give any service any credentials except those created specifically for that service. (This dictum includes the common practice of using the same password for multiple services.) This is not an issue of paranoia. Fraudulent or malicious services are, of course, a concern, but not the only one. You are not only trusting these people to use your credentials appropriately, you're trusting them to store/transmit/manage those data securely. The problem is that this advice will never sink home with users. So Twitter needs to step up and protect its users by implementing OAuth (or something similar). People will do dumb things like this so long as the risks seem remote (and they always will, until it's too late) and there's even a minor benefit to be had. The point is: Anyone that wants to could steal a bunch of Twitter users' passwords right now with hardly any work. Twitter should regard this as a gaping security hole. It doesn't matter that it's not technically a vulnerability in any of the code they've written.