TIPAS : Twitter Instant Password And Storage

TIPAS, the Twitter Instant Password And Storage system is a simple service that creates and stores complex passwords.

** TIPAS is not an official Twitter service and the fine folks at Twitter are not responsible for it's creation or maintenance. Please do not contact Twitter support with questions about TIPAS. **

Q: OK. What's this all about?
A: This is probably best explained through an example. Let's take a look.

Example TIPAS Data
[#040709:1342] (4yyDYqrN) (JuN5VkkUHBdsduB3) (lpIPGMSquMg479J3isfzJJ6I) (YuMNHwkHBveJFoOHNI48PyXiDmjjm8x+) [#w/LzlaV8]

You might immediately recognize that the TIPAS data are broken into unique fragments. The first fragment is the Unique Identifier. Using the data above, the Unique Identifier is: #040709:1342. This is the most important piece of information for you to remember.

After the Unique Identifier, TIPAS provides 5 passwords of various lengths. Using the example above, these include:

08-character password c7y5Z+Of
16-character password GRPA73+Dp/y0ckeQ
24-character password FBsWMD+hJd+OzEgy4JREhqyf
32-character password +bSpGvMmW2L9jXRNbqCEZP7L27mlyfhZ

Finally, the tweet ends with another chunk of data like this: #w/LzlaV8. Originally, I was thinking this could be used as a secondary Unique Identifier, but it could just as easily be used as a password. I say, use it however you like.

Q: So, I check the TIPAS feed, select a password and record the Unique Identifier.
A: You got it.

Making this work for you involves selecting a password of an appropriate length. Pick the password length that make sense to you. Personally, I recommend that you always select the 32-character password. Of course, there are certainly valid reasons for choosing a shorter password. There are equally valid reasons for using all of the passwords together as a passphrase. Looking at the Unique Identifier, you might notice that the format seems familiar. In fact, the Unique Identifier is based on the DATE/TIME of the tweet.

Q: I remember the date/time stuff, but I can't remember my password.
A: Don't worry, we'll just search for it.

To find your password, go here and search for the Unique Identifier. This will bring you to the tweet that contains your password. Go ahead, try it out using the Unique Identifier from the Example TIPAS Data above.

Of course, you'll still have to remember which chunk of TIPAS data you used. Some possible solutions to this include using all the chunks as a passphrase, always selecting a specific length or documenting it in some other way. It's aso worth considering that you can choose *any* of the passwords created by TIPAS. In fact, I recommend that you view TIPAS tweets from the past to mix things up a bit.

Q: Is that it?
A: Essentially, yes. But, let's engage in some security geekery to flesh this out a bit.

One of the primary goals of TIPAS is to allow you to remember a relatively short Unique Identifier, that is easily documented or remembered. If you ever forget your password, you can always search for it on Twitter. The Unique Identifier is based on the DATE/TIME of the tweet containing your password. The time is recorded in GMT, using 24-hour notation.

In our previous example the date and time are, 04/07/09 at 13:42. Basing the Unique Identifier on the date/time seems to simplify the issue of password recall. Also, documenting your secret, if you must, is made easier. Using the example data above, I might document my TIPAS password by circling 04/07/09 on my paper calendar and make a note like "13:42 - the bird is the word".  In my digital calendar I might make an appointment at 13:42 on 04/07/09 to discuss linguistics. Of course, you can simply attempt to remember 04/07.09:1342, but that's not always fun.

Hey, check it out! You're storing your secret in plain sight. Yet, it remains relatively secure against most attacks. That's kind of interesting.

There are a whole bunch of other methods for using this service to establish a secret between yourself and another individual but these discussions are probably most interesting to other security geeks.

Q: Whew. That's a bunch of stuff. So, what the heck is a 'tipas'?
A: Cerro Tipas is a volcano in Argentina. The TIPAS data remind me of lava flows.

The Twitter Instant Password And Storage (TIPAS) system is an attempt to bring awareness to the issue of password complexity. If you're the type of person who believes that complex passwords are difficult and unnecessary, TIPAS will be of little use to you. If you're the type of person who recognizes that complex passwords are worth the effort, you might find that TIPAS is a useful resource. Either way, please enjoy. Come up with creative uses for the data. Or, just sit back and watch it scroll by. It's fun for the whole family.