3 ms·

Former. Also App developers posting their API keys and Consumer Secret keys. So, theoretically, this would allow a malicious person to control all the authorize

by ttol 16y ago

Former. Also App developers posting their API keys and Consumer Secret keys. So, theoretically, this would allow a malicious person to control all the authorized accounts with that app (and these were big name apps). Autotweeting, DMing, access private messages, etc.

abraham 16y ago
Only if they both stole the consumer token and were able to phish the user into going through the authorization flow.
- tptacek 16y ago
  The dev that posts OAuth secrets in support tickets also probably hasn't constructed a fortress of awesomeness around his own user's data, anyways.