Sounds like a clean solution, and very similar to smartcard authentication[1]. It improves on smartcards by showing which application is attempting to authentic

Sounds like a clean solution, and very similar to smartcard authentication[1]. It improves on smartcards by showing which application is attempting to authenticate. It improves on Google Authenticator by allowing faster authentication in the common case that you have Internet access, and removing the shared secret so they can safely deploy the verification to commodity servers. One thing that isn’t clear from the blog post is whether you can have one set of S/KEY backup codes to put in your drawer for when you lose your phone, and another set of backup codes for when the phone is offline (to use just like you use Google Authenticator). Both use cases are important. Another question is whether Twitter intends to open the protocol and app for third parties to use, as Google did with Google Authenticator[2]. A potential sticking point is that the app probably trusts the Twitter servers to not lie when it tells the app that a particular URL in your browser wants to authenticate, and opening the app probably means depending on X.509 certificate chains in order to trust a server request. [1]: http://msdn.microsoft.com/en-us/library/ms953432.aspx http://msdn.microsoft.com/en-us/library/ms953432.aspx [2]: https://code.google.com/p/google-authenticator/ https://code.google.com/p/google-authenticator/