Hacker News Reader

Wait, account passwords were visible?

Was this a case of account passwords being sent to Twitter Support by users - 'hey, I can't login, my password is bigclown' - or does Twitter Support have a way to access the user's actual password?

If it's the latter, that's a time bomb waiting to go off.

View on HN

Former. Also App developers posting their API keys and Consumer Secret keys. So, theoretically, this would allow a malicious person to control all the authorized accounts with that app (and these were big name apps). Autotweeting, DMing, access private messages, etc.

Only if they both stole the consumer token and were able to phish the user into going through the authorization flow.

The dev that posts OAuth secrets in support tickets also probably hasn't constructed a fortress of awesomeness around his own user's data, anyways.

Reply on news.ycombinator.com