5 ms·

Not only do many Twitter apps send your password in the clear, many of them automatically give your Twitter username & password to any Twitter-specific photo/vi

Not only do many Twitter apps send your password in the clear, many of them automatically give your Twitter username & password to any Twitter-specific photo/video hosting service you use with them.

pronoiac 17y ago
Is there an open catalog of these issues somewhere?
tptacek 17y ago
I haven't used any Twitter app that didn't use OAuth. I don't use a lot of Twitter apps, but what's the popular one that still wants your password? I don't love OAuth, but it is at least a decent answer to the concern you're raising.
- pronoiac 17y ago
  I haven't seen OAuth in use on the iPhone, though I've only tried a couple of Twitter clients.
- wooster 17y ago
  Let me present issue 395, the most starred issue on the Twitter API bug tracker: http://code.google.com/p/twitter-api/issues/detail?id=395 http://code.google.com/p/twitter-api/issues/detail?id=395 Also fun: if I have an iPhone client app interacting with Twitter and also with a web service that in turn interacts with Twitter, how does OAuth fit into that scheme? Do I make the user do the OAuth dance for the iPhone app? My web site? Both?
  - tptacek 17y ago
    I'm a lot less concerned about the threat model where one side is your iPhone's persistant store and the other is Twitter. So, no, I think OAuth is probably unnecessary for actual iPhone apps.
- briansmith 17y ago
  See issue #395 below. That stops most mobile applications--except those on the iPhone--from using OAuth. See http://twitpic.com/api.do http://twitpic.com/api.do, http://img.ly/pages/API http://img.ly/pages/API, http://code.google.com/p/imageshackapi/wiki/YFROGuploadAndPost http://code.google.com/p/imageshackapi/wiki/YFROGuploadAndPo..., http://twitrpix.com/api http://twitrpix.com/api, http://twic.li/api http://twic.li/api. All of them require and/or allow the client app to pass the user's Twitter username and password.

Not only do many Twitter apps send your password in the clear, many of them automatically give your Twitter username & password to any Twitter-specific photo/video hosting service you use with them.

pronoiac 17y ago

Is there an open catalog of these issues somewhere?

tptacek 17y ago

I haven't used any Twitter app that didn't use OAuth. I don't use a lot of Twitter apps, but what's the popular one that still wants your password? I don't love OAuth, but it is at least a decent answer to the concern you're raising.

pronoiac 17y ago
I haven't seen OAuth in use on the iPhone, though I've only tried a couple of Twitter clients.
wooster 17y ago
Let me present issue 395, the most starred issue on the Twitter API bug tracker: http://code.google.com/p/twitter-api/issues/detail?id=395 http://code.google.com/p/twitter-api/issues/detail?id=395 Also fun: if I have an iPhone client app interacting with Twitter and also with a web service that in turn interacts with Twitter, how does OAuth fit into that scheme? Do I make the user do the OAuth dance for the iPhone app? My web site? Both?
- tptacek 17y ago
  I'm a lot less concerned about the threat model where one side is your iPhone's persistant store and the other is Twitter. So, no, I think OAuth is probably unnecessary for actual iPhone apps.
briansmith 17y ago
See issue #395 below. That stops most mobile applications--except those on the iPhone--from using OAuth. See http://twitpic.com/api.do http://twitpic.com/api.do, http://img.ly/pages/API http://img.ly/pages/API, http://code.google.com/p/imageshackapi/wiki/YFROGuploadAndPost http://code.google.com/p/imageshackapi/wiki/YFROGuploadAndPo..., http://twitrpix.com/api http://twitrpix.com/api, http://twic.li/api http://twic.li/api. All of them require and/or allow the client app to pass the user's Twitter username and password.