Twitter's OAuth has a gaping security hole
shkspr.mobi
Twitter's OAuth has a gaping security hole
1–10 of 26 posts
Re: Twitter's OAuth has a gaping security hole
#2What approaches do other OAuth providers take to this problem? Revoking all OAuth tokens on a password change/reset takes away a good chunk of the value that many people get from using OAuth.
Re: Twitter's OAuth has a gaping security hole
#3That's a feature, not a bug. In twitter as far as I remember you have the opportunity to revoke tokens yourself. It's definitely not a security hole.
Re: Twitter's OAuth has a gaping security hole
#4That's a feature, not a bug. In twitter as far as I remember you have the opportunity to revoke tokens yourself. It's definitely not a security hole.
It's at the intersection of security and user experience. Changing your password because you think it's been compromised is a different use case from changing your password because you've been using it for years or forgotten it.
Re: Twitter's OAuth has a gaping security hole
#5What approaches do other OAuth providers take to this problem? Revoking all OAuth tokens on a password change/reset takes away a good chunk of the value that many people get from using OAuth.
Agreed, but would it be difficult to have a checkbox marked "revoke all permissions to use my account from all applications" to the reset password menu?
Re: Twitter's OAuth has a gaping security hole
#6Seriously though, why do all the security examples and scenarios always involve an Alice and a Bob?
And why is Alice always the bad guy (or chick)?
Re: Twitter's OAuth has a gaping security hole
#7Seriously though, why do all the security examples and scenarios always involve an Alice and a Bob? And why is Alice always the bad guy (or chick)?
Re: Twitter's OAuth has a gaping security hole
#8Seriously though, why do all the security examples and scenarios always involve an Alice and a Bob? And why is Alice always the bad guy (or chick)?
[deleted]
Re: Twitter's OAuth has a gaping security hole
#9Along the same lines, if you build a twitter app that uses Oauth and change the access from read to read/write the oauth tokens never change and won't work if you try to do a write operation. Even if you log out and log back in manually. More problematic the error is '401 - Unauthorized', blah.
The work around recommended by Twitter? Register a new twitter app that is read/write from the get go. :(
Re: Twitter's OAuth has a gaping security hole
#10Argh, why do we vote up this crude sensationalist crap?