This year's New York Comic Con attendees who chose to connect to their Twitter account when validating their pass online found that the convention was tweeting NYCC promotional material on their behalf. While third-party authorization is grey-area practice gaining traction in the social media landscape, what was unusual was the entitlement acted out by the organizers, online security experts told Polygon.

Michael McKinnon, a security advisor at AVG tells Polygon that an authorization request from Twitter usually has a bulleted list of actions, including "Post Tweets for you." According to some users, this feature didn't come up when they unwittingly authorized access to their Twitter account when activating their RFID-enabled convention badges.

"However, despite that, what is a little unusual in this case is the automated and unapproved sending of Tweets," Michael McKinnon, a security advisor at AVG tells Polygon "Almost all other Twitter applications are either Twitter clients that allow users to post tweets, or share an event such as checking into a venue, for example — all actions that are triggered deliberately by the user. In this case the organisers are taking it upon themselves to send the Tweets when they feel like it; something that users are naturally disagreeable with."

More than 500 tweets, which included the NYCC hashtag and a link to the event's Facebook page were across attendees accounts exclaiming the phrases "So much pop culture to digest! Can't. handle. the. awesome. #NYCC," "I can't get enough #NYCC!" and "So much to see, so much to do! #NYCC 2013 I love you!"

"This is a grey-area practice that is being used more and more often lately by websites that require user authentication via social networking connectors," Bogdan Botezatu, senior e-threat analyst at Bitdefender said. "From a legal perspective, the application has been authorized by the users themselves to post on their behalf, so they should not be surprised when they do."

McKinnon tells Polygon that an authorization request from Twitter usually has a bulleted list of actions, including "Post Tweets for you," a feature that reportedly didn't come up for some when they unwittingly authorized access to their Twitter account when activating their RFID-enabled convention badges.

McKinnon went on to say that the real problem with third party applications isn't its immediate impact, it's in the future when users forget about authorizing the NYCC to Tweet on their behalf.

"What happens with authentication tokens that are sitting out there that could be used to send Tweets from many accounts?" he said. "Who will have access to that data in the future? And so it will be prudent for all attendees who registered to be mindful to review their Twitter application approvals and remove ones that are no longer needed — especially the ones that have write access to send Tweets."

From the security perspective, Botezatu was on the same page, warning against granting access to random applications which have a "damaging impact on the user."

"These applications can use the opportunity to plant malware or spyware, send phishing links or even inappropriate commercials to expand their reach with the network of the victim's friends," he explained. "We advise users to avoid connecting applications to their social network profiles as much as possible, or at least to deny permission to post on their behalf as the compromise or misuse of any of the paired applications could have a devastating impact on the user's private or professional life (i.e. connected applications that automatically share consumed content, especially links to pornography)."

Renowned game designer Richard Garriott, creator of Ultima and now the Kickstarted game Shroud of the Avatar: Forsaken Virtues, has been around the world and seen it from space. He's been in the video game industry for more than 30 years, with much of that time spent in Austin, Tex., although he also maintains a home in New York City.

During a panel at New York Comic Con this afternoon, Garriott spoke about his history as a game developer, and expanded on what he saw as the important distinctions between the game industry in Austin and what he's noticed during his time in New York so far.

Austin quickly became a hub for game development, said Garriott, because it's naturally a city that people in the art and technology fields flock to. But it's been suffering in recent years because it never developed the best educational institutions to bring the next generation of game developers into the industry. More importantly, Garriott explained, there isn't a lot of money for game development in Austin, because few game publishers and developers actually have their corporate headquarters in town. Instead, they tend to be located in California, and maintain satellite offices in Austin.

"Everyone in Austin is on the binge-and-purge cycle of the industry," said Garriott, noting that when companies have to make personnel cuts, they tend to lay people off at the satellite offices first.

New York has its own set of problems, as Garriott sees it. The vast majority of developers in New York are on work-for-hire contracts, performing grunt work such as coding but not sharing in a game's profits. Because of that, they rarely, if ever, get to create and own intellectual property.

Those are the keys to a healthy development industry, according to Garriott: Educate a base of young development talent; establish local corporate headquarters, not satellite offices; and "figure out a way to build original IP."

Apparently, the contractors running the Department of Health and Human Services' HealthCare.gov website did not reset customer passwords this week. According to CNN, HHS officials now say that call center operators for the website's help line were erroneously given scripts that mentioned the password reset.

People trying to register for health insurance through the site were being told as late as Thursday morning that the reason they were unable to log into their accounts on HealthCare.gov was because of a system-wide password reset, as Ars reported on Tuesday. But an HHS representative told CNN, "A wrong script was provided to call center representatives. It's been corrected. The wrong script was read for only a short time—just this morning."

Ars attempted to contact HHS officials on Tuesday for comment, but a spokesperson at the Center for Medicare Services, which oversees the program, could not provide a comment. Still, it's clear from reports from individuals who spoke with HealthCare.gov's Advanced Response Center—the call center responsible for customer issues elevated beyond the initial help desk line—that the ARC was telling people that passwords had been reset much earlier than Thursday morning.

Here's the dialog you'll see if you were opted out of search, when Facebook gets around to opting you back in.

Facebook

If you checked that box saying you don’t want to appear in Facebook search results, get ready: soon, that choice is going away. Facebook announced in a blog post Thursday that it's removing the ability to opt out of appearing in search results, both for friends and globally, for those who’ve had it enabled.

Facebook actually removed the search opt-out for everyone who didn’t have it enabled early this year, around the time it introduced Graph Search. Now, ten months later, Facebook is giving the boot to anyone who actually cared enough to opt out, referring to the checkbox as an “old search setting.” Facebook claims that less than one percent of users were taking advantage of the feature.

In simpler times, Facebook was smaller and easier to navigate, and everyone had a privacy setting asking “Who can look up your timeline by name?” Now that there are so many profiles that users become confused when they know they have a friend or know someone in a group, but try to find them by search and they don’t appear, says Facebook.