3 ms·
No way I'm signing in with my twitter account to any of your projects. I'm being cautious because I still remember your blogpost about storing passwords of 3rd
by gecko_dude 15y ago
No way I'm signing in with my twitter account to any of your projects. I'm being cautious because I still remember your blogpost about storing passwords of 3rd party accounts in plain text.
Relevant: http://swizec.com/blog/small-trick-for-seamless-base64-password-storage-in-django/swizec/1378 http://swizec.com/blog/small-trick-for-seamless-base64-passw...
- wccrawford 15y agoI don't think you understood his post, or how you sign into a third-party site with Twitter or Facebook. His post was about sites that DO NOT do OAUTH, and the only way to store passwords to interface with those sites. He clearly states how insecure it is, and the base64 thing is only to prevent you from reading their password accidentally. Twitter, however, DOES use OAUTH. There's no need to store your twitter password on his side at all. His auth page is down right now so I can't check, but I'm betting that it ends up at a twitter.com OAUTH page that is perfectly safe.
- gecko_dude 15y agoI understood his post perfectly well. By using base64 to store passwords is just as bas as storing them in plain text, because you only rely on the good will of the person who has access to them. When dealing with security, this sort of practice should be avoided at all costs e.g. a sacrifice to the functionality of your product.
- cromulent 15y agoAre you suggesting that Twitter is going to give him your password, so that he might store it in plain text? I don't understand how that could happen. Twitter's OAuth implementation seems fairly sound.