About Spotify, a friend of mine using it sent me a link to their website yesterday, and by visiting this link I was logged into her account, could see her personal informations and even change her password. I tweeted[1,2] about it as soon as I realized it. It's really a shame such a big website is so low on security…
I guess it might be a link from their desktop app to their website that she followed, but at least they could redirect to a clean url after having authenticated the user, it's okay that she sent that link to me (it was just to show me the prices of Spotify's monthly subscriptions), but what if she shared it publicly on Twitter or Facebook?
Having a spotify/itunes-esq UI for youtube is a great idea, but this is just ripping off Spotify a bit too closely IMHO.
However, I seem to remember that a German competitor for Spotify has done almost the exact same UI copy - so maybe Spotify aren't that bothered by it. It's not as if their UI is that ground breaking (as someone else comments, it much like iTunes), it's the backend tech that makes Spotify so good.
Not so much like the fact that it's pretty much Spotify's interface copied to the smallest detail.