Twitter Security Issue • Hacker News Board

Re: Twitter Security Issue

#11

Post by ivankirigin » Mon, Nov 24, 2008, 2:48 PM UTC

tlrobinson wrote: post #3

ivankirigin wrote: post #2

How about this for a twitter security issue: users are accustomed to giving their passwords to many third party twitter-API apps.

Yeah they need to implement OAuth or something similar.

Even if they do, the culture of the existing community is set. Phishing will be a problem. I should have bought Tvvitter.com

Re: Twitter Security Issue

#12

Post by danw » Mon, Nov 24, 2008, 2:52 PM UTC

tlrobinson wrote: post #3

ivankirigin wrote: post #2

How about this for a twitter security issue: users are accustomed to giving their passwords to many third party twitter-API apps.

Yeah they need to implement OAuth or something similar.

From what I understand is that OAuth was created when twitter developers identified this as a problem. The trouble is they were too busy fighting to keep twitter alive to roll it out on their own api.

Re: Twitter Security Issue

#13

Post by tlrobinson » Mon, Nov 24, 2008, 5:54 PM UTC

kajecounterhack wrote: post #9

tlrobinson wrote: post #4

I suspect this is actually a very common issue. Unless you explicitly expire all sessions for a user when they change their password then this will happen.

Well when you say common, do you mean with another application that utilizes an open API that is connected to many popular platforms and that is as widely used as Twitter? Not many come to mind.

I would guess that it's true for many APIs which rely on the user providing their password to the 3rd party application.

Of course that's the bigger problem. The user shouldn't have to give their password out. It's somewhat ironic that Twitter doesn't implement OAuth or something similar since Blaine Cook started OAuth.