3 ms·

In startup-time, anything that takes a day to do is worse than something equivalent that takes 20 minutes. Auth'ing Twitter using a user/pass meant that I coul

In startup-time, anything that takes a day to do is worse than something equivalent that takes 20 minutes. Auth'ing Twitter using a user/pass meant that I could add Twitter support to Blogabond in 20 minutes. Reading Twitter's oAuth instructions took longer than that. For the amount of geek-cred it'd buy me, and the added headache if somebody physically broke into my datacenter and stole the production server, it's just not worth the extra time to implement. As to your first point, naturally I have absolutely no leg to stand on there. Your mom will still use her bank password for her Twitter account, and I'm a bad person for storing it.

tptacek 17y ago
You think it's my mom I'm trying to protect here, but it's not. It's you. You're the one who's going to lose the user table in your database. Please take my word on that. Don't let it be full of valid passwords.
- JeremyBanks 17y ago
  Maybe a bit of an improvement over the current method of using passwords would be to take the user's username and password, immediately using them to connect the account using OAuth, and then store them no longer. This would make the connection persistent if the user changed their password, and would eliminate a lot of the risk.
joshu 17y ago
I don't think I agree. It really depends on the transaction cost of the thing implemented. If it takes a day to implement something that has a 2x signup rate that the 20 minute thing, you are clearly making a bad tradeoff. This is engineering. There are no absolutes, just a series of tradeoffs.
marilyn 17y ago
This is the sort of time saver that will cost you time later, when you want to spend your time on authentication even less. Twitter is wanting to cut off basic auth because of "security issues" (http://apiwiki.twitter.com/OAuth-FAQ#WhenareyougoingtoturnoffBasicAuth http://apiwiki.twitter.com/OAuth-FAQ#Whenareyougoingtoturnof...), and while OAuth isn't required now, it likely will be soon.
warfangle 17y ago
And now that you've read the oAuth instructions, you should understand oAuth. It took me six hours to implement it for the first time, including reading the documentation. Granted, I was using a third-party library to handle the API interaction because, well, it's already been done - so why re-do it? ;)
simonw 17y ago
This is a tragedy of the commons thing. As a web developer, you have a moral responsibility to help your users stay secure online. Teaching them that it's OK to enter their Twitter username and password on any site that asks for it (when Twitter are trying to teach them what OAuth is and why it matters to them) is irresponsible. Sure, it's cheaper to implement. But you should be better than that.
ErrantX 17y ago
> Auth'ing Twitter using a user/pass meant that I could add Twitter support to Blogabond in 20 minutes. Reading Twitter's oAuth instructions took longer than that. With all due respect; I wrote a library for Kohana PHP which allowed Twitter to be used as a login in about an hour. If I'd just been integrating it would have been faster. The beauty of Oauth is that it conforms to a specification - so any Oauth library for whatever language your working with will co-operate with Twitter. I'd argue that the ease of implementation means that even if it saves you from one in a thousand chance of that headache it's worth it :)

tptacek 17y ago

You think it's my mom I'm trying to protect here, but it's not. It's you. You're the one who's going to lose the user table in your database. Please take my word on that. Don't let it be full of valid passwords.

JeremyBanks 17y ago
Maybe a bit of an improvement over the current method of using passwords would be to take the user's username and password, immediately using them to connect the account using OAuth, and then store them no longer. This would make the connection persistent if the user changed their password, and would eliminate a lot of the risk.

joshu 17y ago

I don't think I agree. It really depends on the transaction cost of the thing implemented. If it takes a day to implement something that has a 2x signup rate that the 20 minute thing, you are clearly making a bad tradeoff. This is engineering. There are no absolutes, just a series of tradeoffs.

marilyn 17y ago

This is the sort of time saver that will cost you time later, when you want to spend your time on authentication even less. Twitter is wanting to cut off basic auth because of "security issues" (http://apiwiki.twitter.com/OAuth-FAQ#WhenareyougoingtoturnoffBasicAuth http://apiwiki.twitter.com/OAuth-FAQ#Whenareyougoingtoturnof...), and while OAuth isn't required now, it likely will be soon.

warfangle 17y ago

And now that you've read the oAuth instructions, you should understand oAuth. It took me six hours to implement it for the first time, including reading the documentation. Granted, I was using a third-party library to handle the API interaction because, well, it's already been done - so why re-do it? ;)

simonw 17y ago

This is a tragedy of the commons thing. As a web developer, you have a moral responsibility to help your users stay secure online. Teaching them that it's OK to enter their Twitter username and password on any site that asks for it (when Twitter are trying to teach them what OAuth is and why it matters to them) is irresponsible. Sure, it's cheaper to implement. But you should be better than that.

ErrantX 17y ago

> Auth'ing Twitter using a user/pass meant that I could add Twitter support to Blogabond in 20 minutes. Reading Twitter's oAuth instructions took longer than that. With all due respect; I wrote a library for Kohana PHP which allowed Twitter to be used as a login in about an hour. If I'd just been integrating it would have been faster. The beauty of Oauth is that it conforms to a specification - so any Oauth library for whatever language your working with will co-operate with Twitter. I'd argue that the ease of implementation means that even if it saves you from one in a thousand chance of that headache it's worth it :)