Hacker News Reader

Comment by pronoiac | Hacker News Reader

I've been wondering this about Twitter apps lately.

Not only do many Twitter apps send your password in the clear, many of them automatically give your Twitter username & password to any Twitter-specific photo/video hosting service you use with them.

I haven't used any Twitter app that didn't use OAuth. I don't use a lot of Twitter apps, but what's the popular one that still wants your password?

I don't love OAuth, but it is at least a decent answer to the concern you're raising.

See issue #395 below. That stops most mobile applications--except those on the iPhone--from using OAuth.

See http://twitpic.com/api.do, http://img.ly/pages/API, http://code.google.com/p/imageshackapi/wiki/YFROGuploadAndPo..., http://twitrpix.com/api, http://twic.li/api. All of them require and/or allow the client app to pass the user's Twitter username and password.

Let me present issue 395, the most starred issue on the Twitter API bug tracker:

http://code.google.com/p/twitter-api/issues/detail?id=395

Also fun: if I have an iPhone client app interacting with Twitter and also with a web service that in turn interacts with Twitter, how does OAuth fit into that scheme? Do I make the user do the OAuth dance for the iPhone app? My web site? Both?

I'm a lot less concerned about the threat model where one side is your iPhone's persistant store and the other is Twitter. So, no, I think OAuth is probably unnecessary for actual iPhone apps.

I haven't seen OAuth in use on the iPhone, though I've only tried a couple of Twitter clients.

Is there an open catalog of these issues somewhere?

Largely irrelevant - at least for now, since Twitter, Facebook and a host of other social networking sites are currently blocked in China.

It's relevant for other snooping & MITM attacks. Twitter's DNS hack last month was cause for concern for me.

Reply on news.ycombinator.com