4 ms·

The only way to do it securely is the way Flickr's App does it with Yahoo OAuth. Launch Safari. Terrible experience, but very secure.

• ceejayoz 16y ago
  Assuming, of course, that the app didn't just make it look like it's launching Safari.
  • somebear 16y ago
    You should be able to check whether it actually launches safari, e.g. by pressing the home button and the actually launching safari, should look the same as the screen you just left.
    • kisielk 16y ago
      Because that's convenient and obvious...
      • somebear 15y ago
        I didn't say that it was either, just that it was possible.
    • hboon 16y ago
      Most of us here would be, but most of us out there wouldn't. It isn't secure if it only works for the techie folks.
    • jerf 16y ago
      On Linux, even if the Twitter app on your desktop launches a browser, it can still do a very effective job of sniffing your password simply by asking the desktop environment for the relevant events. It only works in the browser because everything is sandboxed, with a particular focus on sandboxed-by-domain. See http://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-on-gui-isolation.html http://theinvisiblethings.blogspot.com/2011/04/linux-securit... , for instance. There are ways to do that on all the desktop environments, I presume, with varying degrees of officialness and popping up administrator password dialogs.