Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter's OAuth has a gaping security hole

shkspr.mobi

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Twitter's OAuth has a gaping security hole

#13

Post by kwamenum86 »

oscardelben wrote: post #3

That's a feature, not a bug. In twitter as far as I remember you have the opportunity to revoke tokens yourself. It's definitely not a security hole.

Many people cannot understand the difference between a browser and an OS or the difference between Firefox and IE. How can we expect them to manage their OAuth tokens? When OAuth was first writtes many SITES did not even have it implemented correctly (Myspace is a notable example.)

In general, having the average naive user administer any aspect of security beyond choosing a "secure" password is a naive expectation. You can't afford to have both parties acting naively when it comes to Internet security. For this (non-naive) audience, managing OAuth tokens makes sense and Twitter can afford to be naive. For the rest of the Internet audience this approach is probably more dangerous than convenient.

Re: Twitter's OAuth has a gaping security hole

#15

Post by tptacek »

munctional wrote: post #12
genieyclo wrote: post #6

Seriously though, why do all the security examples and scenarios always involve an Alice and a Bob? And why is Alice always the bad guy (or chick)?

You need to read Applied Cryptography.

Or, better yet, any other book on cryptography; Applied might be the worst crypto book available.

Re: Twitter's OAuth has a gaping security hole

#16

Post by tptacek »

digamber_kamat wrote: post #11
rabble wrote: post #10

Argh, why do we vote up this crude sensationalist crap?

I think it is possible to criticize in a more civilized and conversant manner. Moreover it is expected from users at HN.

Calling a person "crap" is uncivilized. Calling a story "crap" is just blunt.

Re: Twitter's OAuth has a gaping security hole

#18

Post by tptacek »

smanek wrote: post #17
tptacek wrote: post #15

Earlier quoted context omitted.

Or, better yet, any other book on cryptography; Applied might be the worst crypto book available.

Can you recommend a better one?

Practical Cryptography, Ferguson and Schneier. Written partly as penance for Applied Cryptography.
Post reply on HN