5 ms·

For people who think this is going to cause drive-by Twitter hijacks, remember that Twitter stores the callback URL on their side for this very reason. Any web

by Kudos 14y ago

For people who think this is going to cause drive-by Twitter hijacks, remember that Twitter stores the callback URL on their side for this very reason. Any web app impersonating these apps will fail at the callback stage.

zwily 14y ago
The client can intercept whatever URL the embedded webview is redirected to. The callback URL provides no security against this.
- Kudos 14y ago
  That's not a drive-by hijack, all bets are off when it comes to apps. For all you know the app is presenting a fake login dialog. It would be a drive-by hijack on the web because there's a good chance you're already authenticated with Twitter and the callback cycle will automatically grant credentials on your behalf to the requester with no prompt.
  - zwily 14y ago
    Right - we were discussion OAuth in the context of client apps.
    - Kudos 14y ago
      I'm pretty sure I was setting the context, and that context was the web.
      - zwily 14y ago
        Fair enough. I was referring to the larger discussion.
voyou 14y ago
The Twitter API lets you specify the callback URL as part of the request: https://dev.twitter.com/docs/api/1/post/oauth/request_token https://dev.twitter.com/docs/api/1/post/oauth/request_token However, Twitter also requires users to authorize the application each time an application requests an OAuth token, so the possibility of using these keys for hijacking is limited (although it might be possible to use them to make a phishing attempt look more authentic).