Hacker News Reader

Does twitter honor the the oauth_callback parameter? Otherwise, how can those keys be used by an attacker?

oauth_callback is only interesting for web app authorization. For out-of-band authorization flows, you can't protect it with a callback filter.

Since these keys were lifted from an application that does out-of-band auth flows, any other app could use them similarly at will.

The Twitter apps don't use the OOB flow. They use xAuth password exchange "flow".

Nope, untrue. Read the description for oauth_callback.