3 ms·
Availability is a security property too. The article isn't really saying there's a security problem in OAuth alone, but that there's a security problem in the
by caf 16y ago
Availability is a security property too.
The article isn't really saying there's a security problem in OAuth alone, but that there's a security problem in the overall system consisting of OAuth, Twitter's mandating use of it in a way it wasn't intended, and Twitter's presumed policy of disabling "compromised" keys.
- tptacek 16y agoHas Twitter actually shut down any application anyone's heard of with this policy, or is this just scaremongering? Because, again, Twitter has a variety of ad-hoc means at its disposal to block clients without going anywhere near OAuth. Meanwhile: "using OAuth in a way it wasn't intended" is not the same thing as a "compromise" in Twitter's OAuth system. And yet thats the headline of the article.
- caf 16y agoThey've said they will, which is good enough for me. I agree that the headline is misleading.