Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of this account being compromised?
In my opinion, the ideal scenario would be (1) multiple users having posting permissions, and no user having admin permissions, combined with (2) posting to the account indirectly, via a service that can be used only to post but not to change settings.
I can achieve this with Twitter: The account is never used from any browser or app. The password is stored in a safe place offline. Each user has set up a Tweetdeck account and associated the twitter account with it. This way they can post to twitter, but can't change the original twitter password or any other setting. If someone unauthorised gains access to the tweetdeck account of any team member, the worst possible outcome would be tweets. If the original twitter account is hacked, or the password forgotten, the usual account recovery takes place. As the original account is used only indirectly, it is in fact less insecure than an account used frequently.
This approach also helps in the case of hit by a bus: the email used for twitter account is an email account belonging to the organization, so getting account recovery info is trivial.
It doesn't occur to me a similar approach on Facebook (or other social networks where there's a secondary profile linked to a personal profile. I think Google Plus also behaves that way)?
In Facebook, at least one user has to be admin of a "page". The admin credentials are linked to the daily-use personal account. If this personal account is compromised, the entire page is compromised. Multiple users can be admins, but it will only multiple the risks, as a single admin can remove all other admins.
Combine this with the immense number of malware and xss attacks aimed at facebook, as well as fake login screens and social engineering attacks.
1) Is my assumption and approach to posting on twitter correct or flawed? 2) If (1) is correct, how to proceed about posting to FB?