Here's how that major Tweetdeck vulnerability works

The popular Twitter app Tweetdeck is shutting down after the discovery of a serious security vulnerability in the software:

We've temporarily taken TweetDeck services down to assess today's earlier security issue. We'll update when services are back up.

— TweetDeck (@TweetDeck) June 11, 2014

Tweetdeck is vulnerable to what is known as a cross-site scripting attack that allows hackers to execute code on the victim's computer. The attack makes use of the JavaScript programming language, which powers most of the web's interactive content. If someone puts JavaScript code into a tweet, your Twitter client is supposed to convert that into harmless plain text. But the Tweetdeck forgot to do that, causing the user's computer to execute it instead.

JavaScript programs are executed within a "sandbox" that sharply limits what they can do

The result: if you were running Tweetdeck, anyone in your Twitter timeline could force your computer to execute JavaScript code. For example, it could cause annoying popup messages to display on a user's screen. Or create viral tweets that spread by causing users to automatically retweet them.

Fortunately, JavaScript programs are executed within a "sandbox" that sharply limits what they can do. In this case, malicious code can only do things that the Twitter app itself is allowed to do, like tweet, follower users, or retweet others' messages. But it likely can't access private files on a user's hard drive, read a user's email, or install long-lived spyware on the computer.

This is an important virtue of the web compared with conventional desktop software. If a bug is discovered in a traditional Mac or Windows application, the attacker will often gain total control over a user's computer. In contrast, web browsers (and apps like Tweetdeck built on web-based technologies) are carefully designed to limit the damage that malicious JavaScript can do.

A security problem in Twitter, Facebook, or Gmail can still cause a lot of headaches for users. It could allow hackers to access private emails or spam victims' friends. But in most cases, it won't give the attacker total control over your computer or even other websites.

We have a request

Vox's journalism is free because we believe that everyone deserves to understand the world that they live in. That kind of knowledge helps create better citizens, neighbors, friends, parents, consumers and stewards of this planet. In short, understanding benefits everyone. You can join in on this mission by making a financial gift to Vox today. Reader support helps keep our work free, for everyone. Will you join us?

One-Time Monthly Annual

$95/year

$120/year

$250/year

$350/year

Other

$

Yes, I'll give $120/year

Yes, I'll give $120/year

We accept credit card, Apple Pay, and Google Pay. You can also contribute via