Edit: OK, I was wrong, as I'd hoped - you don't need a web browser. The rest of my post stands unchanged as, regardless of my interpretation, it kills the Twitt

Edit: OK, I was wrong, as I'd hoped - you don't need a web browser. The rest of my post stands unchanged as, regardless of my interpretation, it kills the Twitter support I just wrote in less than an hour into one of my apps, and renders it a multi-hour (if not day) redevelopment. I'll probably just kill the feature. This seems like a silly move: What was previously a very easy to target platform is now much less easy. Was there a glut of user credential theft from the basic authentication API that's caused this? Or is it the architectural purists winning out over engineering pragmatism? I'm not convinced that, on most devices, it will actually add any security anyway. Consider iPhone application "EvilTwitter". User enables Twitter support. I, evil developer, present a fake Twitter OAuth page. This looks identical to the Twitter login page, carefully configured to hide most of the Safari interface (as 99% of iPhone Safari embedders do). The user enters their details, I steal them, the present a "Woops, wrong password" error. I redirect them to the real OAuth verification page. From here on, my application works fine - the user just assumes they mistyped their details the first time (as mobile device users do, well, continuously).