3 ms·

Wait, account passwords were visible? Was this a case of account passwords being sent to Twitter Support by users - 'hey, I can't login, my password is bigclow

Wait, account passwords were visible? Was this a case of account passwords being sent to Twitter Support by users - 'hey, I can't login, my password is bigclown' - or does Twitter Support have a way to access the user's actual password? If it's the latter, that's a time bomb waiting to go off.

ttol 16y ago
Former. Also App developers posting their API keys and Consumer Secret keys. So, theoretically, this would allow a malicious person to control all the authorized accounts with that app (and these were big name apps). Autotweeting, DMing, access private messages, etc.
- abraham 16y ago
  Only if they both stole the consumer token and were able to phish the user into going through the authorization flow.
  - tptacek 16y ago
    The dev that posts OAuth secrets in support tickets also probably hasn't constructed a fortress of awesomeness around his own user's data, anyways.