> When Twitter receives a new login request with a username and password, the server sends a challenge based on a 190-bit, 32 character random nonce, to the mob

> When Twitter receives a new login request with a username and password, the server sends a challenge based on a 190-bit, 32 character random nonce, to the mobile app — along with a notification that gives the user the time, location, and browser information associated with the login request. Presumably the user must sign not only the nonce, but also the request notification details displayed in the app, so Twitter can verify that the user approved the request it actually sent.