4 ms·
Its not just password security. A big part of oath is to control the API better. Twitter can now shut down misbehaving apps/sites by revoking their key. Sure,
by MichaelApproved 16y ago
Its not just password security. A big part of oath is to control the API better. Twitter can now shut down misbehaving apps/sites by revoking their key.
Sure, you might just be able to create a new user and key if you get banned but this still gives them one more tool and a better picture of who is sending what over their network.
- barrkel 16y agoEven easier, malicious apps can simply use another client app's key. OAuth wasn't really designed for desktop client authentication. The revocation you propose is predicated on the app key being a secret, but desktop clients can't keep secrets. See the section in the relevant RFC: http://tools.ietf.org/html/rfc5849#section-4.6 http://tools.ietf.org/html/rfc5849#section-4.6