Hacker News Reader

Comment by Getahobby | Hacker News Reader

Couldn't agree more. As much as I dislike Gruber's style (all snark, all the time) the man is intelligent. How he does not see that less sharing of credentials equals better security is beyond me. This is clearly a security win. Definitely a usability loss but welcome to infosec. That is the battle.

View on HN

It is a security win (and Im pretty sure gruber sees that).

His point is that the interface is a usability loss, and a big one.

He goes out of his way to say it doesn't increase security.

How is it a security win in a native app? The app controls the web view and can get at the password. It is the illusion of security with the added confusion of acting different than other services (like e-mail).

Quite right. I was momentarily blinded by the idea of being able to grant specific access rights to specific applications without giving them password access, but clearly if they control they web view you are doing this by, not much has been gained.

Twitter's API does not only service native (smartphone) apps. xAuth is always abysmal security; OAuth provides in some cases some increased security.

Which is the whole point of the argument:

OAuth makes sense for browser based applications/access from one web application to another. It makes no sense for native apps since those can still grab your credentials in a wild variety of ways.

If you agree with that, then you should see that the change from

"Choose xAuth or OAuth, based on preference and usage"

"Use OAuth unless you are the official Twitter client, if it makes sense or not"

is questionable.

These two arguments are separate. A malicious app that steals credentials (wait, in Gruber's world these apps are vetted, right?) is going to steal credentials whether it uses xauth or oauth. A non malicious app that uses xauth could in theory be exploited to reveal credentials whereas if it just used oauth it wouldn't be an issue of the same magnitude. It is a security win. You can argue the magnitude of the win all you want.

Reply on news.ycombinator.com