A few weeks ago, HootSuite initiated some new security measures designed to combat instances where user’s accounts might be compromised. The issue was that many people use the same email address and password combination for HootSuite as they do for other online services. If your account information is obtained due to a security breach on one of those other services, the hacker could use that data to log into your HootSuite account and wreak havoc with your connected social networks.
HootSuite’s solution was brilliant.
First, HootSuite has begun to track what IP address you use to login. The first time you login using any new IP address, you will be asked to verify your account using one of your connected social networks, like Twitter. This means that you will also have to be logged into your Twitter account, and that a potential hacker would have to have such access to proceed with a HootSuite login.
As long as you maintain a different password for each of your social networks and HootSuite, your account could never be compromised in this way.
Second, regardless of whether or not the secondary authentication is successful, HootSuite will immediately send you an email stating that a potentially suspicious login attempt was just made on your account, and provide you with the location (if available), date and IP. It looks like this:
If it was you, if you happened to be logging in at a different location (as I was Wednesday when I was logging in while at a coffee shop), you can safely delete the email and disregard the notice.
If, however, it wasn’t you, you now have immediate notice that multiple accounts have been compromised – both HootSuite and one or more connected social networks – and have some work to do. Log into HootSuite and each of your social networks and change all of your passwords right away – and make sure they’re all different and strong.
Such email notifications will come from no-reply@hootsuite.com so make sure that email address is not filtered to your Spam folder. I might suggest creating a quick filter that would automatically put such messages in your Inbox and mark them as Important.
Note that while the email says the login attempt was blocked, that’s only true if the user was unable to authenticate using Twitter or Facebook. If they were, then access would have been granted, as was the case for me.
Since the email notification occurs immediately, it will be sent to you before a hacker would have time to change your email address, ensuring that you will be aware of the issue at the very least. If you get such an email and then are unable to login, it means that your account has been compromised and that the hacker changed your email or password or both, and that you will need to notify HootSuite or the affected social network immediately and work with Customer Support to restore your account.
Make sure that you’re using different, secure passwords for all of your social networks and important online accounts, and me mindful of the security measures services like HootSuite have in place so that you can respond accordingly.
If you have further questions or concerns regarding HootSuite or the security of your social media accounts, please let me know.