3 ms·
Not everyone is using OAuth 2. Mastercard makes a security decision to stay with OAuth 1.0a. https://news.ycombinator.com/item?id=17482178 https://news.ycombina
by woranl 8y ago
Not everyone is using OAuth 2. Mastercard makes a security decision to stay with OAuth 1.0a. https://news.ycombinator.com/item?id=17482178 https://news.ycombinator.com/item?id=17482178
- brlewis 8y agoAlso twitter whenever the app is supposed to act on behalf of a user. (OAuth 2 is simpler, and is available for accessing public data not on behalf of a user.) https://developer.twitter.com/en/docs/basics/authentication/overview/oauth.html https://developer.twitter.com/en/docs/basics/authentication/...
- dwaite 8y agoTwitter is very reluctant to find out how much removing OAuth 1.0a (and their previous incarnations like XAuth) will break in their legacy infrastructure and for existing trusted clients. A migration path would mean adding OAuth 2 in addition to all the previous mechanisms, and then likely acting over a long migration timeline.
- dwaite 8y agoIts worth noting that MasterCard has made non-standardized extensions onto OAuth 1.0a to meet their needs.