Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I think Twitter’s OAuth-only Access is a Waste of Time

simplechatter.com

Post reply on HN
Print view View original

11–20 of 33 posts

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#11

Post by roelbondoc »

I've created 2 small web apps that made use of Twitter and authenticated via oauth. It's been pretty simple for the most part. Since I develop in rails, I've had the pleasure of using twitter-auth for authentication.

Generally speaking though, this is a great move by Twitter in my opinion. I'm always a bit concerned when a 3rd party website asks for a username and password. In some cases I no longer provide credentials when I know a certain service provides oauth.

It might not be as easy for non-web based applications, but I'm sure things will improve in the long run.

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#12

Post by mcantelon »

jackowayed wrote: post #7

OAuth is also a huge pain for those "I just want to write a little Twitter API script in 5 minutes" things. To the extent that I've thought about writing a couple lately, but chose not to because I didn't want to deal with OAuth (and they were scripts I'd want to work in the future). It seems like there should be some solution that lets me use basic auth for those little scripts. Maybe tell Twitter IP's from which I…

An opt-in, per user, enable of basic auth might be a nice thing, but probably a hassle for them to implement.

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#13

Post by elliottkember »

jackowayed wrote: post #7

OAuth is also a huge pain for those "I just want to write a little Twitter API script in 5 minutes" things. To the extent that I've thought about writing a couple lately, but chose not to because I didn't want to deal with OAuth (and they were scripts I'd want to work in the future). It seems like there should be some solution that lets me use basic auth for those little scripts. Maybe tell Twitter IP's from which I…

I made a fun little app for this: http://simpleauthtwitter.heroku.com/ it's not very complicated, but it might help.

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#14

Post by danhak »

I'll grant you that xAuth is a little convoluted. With that said, Twitter deserves credit for being unprecedentedly accommodating and transparent during the transition away from basic auth. It is obviously in their best interest not to break applications, but this hasn't stopped other social networks cough from yanking the rug from underneath scores of apps with little to no warning.

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#15

Post by MichaelApproved »

Its not just password security. A big part of oath is to control the API better. Twitter can now shut down misbehaving apps/sites by revoking their key.

Sure, you might just be able to create a new user and key if you get banned but this still gives them one more tool and a better picture of who is sending what over their network.

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#16

Post by josephholsten »

Seems like this author just doesn't realize how painful migrating to OAuth is for a service provider. Of course xAuth isn't a real security improvement to HTTP Basic. But it forces everyone to support auth that isn't inherently broken. So once Twitter stops receiving many xAuth requests, they can just turn it off.

The migration to OAuth 2 will be interesting though. All the existing clients will have the right kind of structure to plug in drop in a replacement flow, but I bet there will still be a bunch of complaints. "OMG I don't want to use HTTPS! This is so hard! Who cares that I can use curl to debug now, I want programming to be drag and drop." Haters gonna hate.

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#17

Post by paulgb »

I wrote a simple script to post an RSS feed that my university uses to twitter. (Actually, I hacked up Stammy's It currently has about 190 followers, but it used Basic Auth so it stopped working on Thursday.

Rather than switching to OAuth, I'm tempted to just write a mechanize script to make posts using the web interface. Has anybody tried this approach?

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#18

Post by cmelbye »

This makes me quite annoyed as well. Whenever I've asked Twitter about it, they simply say "The applications still use an OAuth access token to access the API, so it's still a secure authentication option." That's not the problem. The application may have to use the access token to use the API, but there's absolutely nothing stopping them from storing the password in their databases behind the scenes.

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#19

Post by barrkel »

MichaelApproved wrote: post #15

Its not just password security. A big part of oath is to control the API better. Twitter can now shut down misbehaving apps/sites by revoking their key. Sure, you might just be able to create a new user and key if you get banned but this still gives them one more tool and a better picture of who is sending what over their network.

Even easier, malicious apps can simply use another client app's key. OAuth wasn't really designed for desktop client authentication. The revocation you propose is predicated on the app key being a secret, but desktop clients can't keep secrets.

See the section in the relevant RFC:

http://tools.ietf.org/html/rfc5849#section-4.6

Re: I think Twitter’s OAuth-only Access is a Waste of Time

#20

Post by miguelpais »

paulgb wrote: post #17

I wrote a simple script to post an RSS feed that my university uses to twitter. (Actually, I hacked up Stammy's It currently has about 190 followers, but it used Basic Auth so it stopped working on Thursday. Rather than switching to OAuth, I'm tempted to just write a mechanize script to make posts using the web interface. Has anybody tried this approach?

I have made exactly the same thing! But now I guess I'll either read their documentation or use one of the scripts/libs listed above.
Post reply on HN