4 ms·

I agree! I really liked OAuth 1.0, especially from a security POV. But, the working group has moved on, and OAuth 2 is the standard now :x

• woranl 8y ago
  Not everyone is using OAuth 2. Mastercard makes a security decision to stay with OAuth 1.0a. https://news.ycombinator.com/item?id=17482178 https://news.ycombinator.com/item?id=17482178
  • brlewis 8y ago
    Also twitter whenever the app is supposed to act on behalf of a user. (OAuth 2 is simpler, and is available for accessing public data not on behalf of a user.) https://developer.twitter.com/en/docs/basics/authentication/overview/oauth.html https://developer.twitter.com/en/docs/basics/authentication/...
    • dwaite 8y ago
      Twitter is very reluctant to find out how much removing OAuth 1.0a (and their previous incarnations like XAuth) will break in their legacy infrastructure and for existing trusted clients. A migration path would mean adding OAuth 2 in addition to all the previous mechanisms, and then likely acting over a long migration timeline.
  • dwaite 8y ago
    Its worth noting that MasterCard has made non-standardized extensions onto OAuth 1.0a to meet their needs.