3 ms·

That's a feature, not a bug. In twitter as far as I remember you have the opportunity to revoke tokens yourself. It's definitely not a security hole.

mooism2 17y ago
It's at the intersection of security and user experience. Changing your password because you think it's been compromised is a different use case from changing your password because you've been using it for years or forgotten it.
- cgranade 17y ago
  At the risk of encouraging Yet Another Warning, would displaying a notice after changing passwords that sites are still authorized be a solution? I'd say that it should have links to more info and to the Connections page, but I despair of users giving up at any sign of warnings. As looking at the issues with that infamous little "lock" icon to indicate HTTPS shows, security and UX intersections are always difficult.
  - mooism2 17y ago
    Possibly display a list of recently authorised sites (and when they were authorised), and make it easy to revoke them without going to another page. It's difficult because people don't expect another step after they've changed their password, and (I'd guess) wouldn't immediately understand the need for it. Perhaps the answer is Yet Another Configuration Setting: the default option revokes all site authorisations when you change your password; the alternate option allows (but forces) you to think about it.
kwamenum86 17y ago
Many people cannot understand the difference between a browser and an OS or the difference between Firefox and IE. How can we expect them to manage their OAuth tokens? When OAuth was first writtes many SITES did not even have it implemented correctly (Myspace is a notable example.) In general, having the average naive user administer any aspect of security beyond choosing a "secure" password is a naive expectation. You can't afford to have both parties acting naively when it comes to Internet security. For this (non-naive) audience, managing OAuth tokens makes sense and Twitter can afford to be naive. For the rest of the Internet audience this approach is probably more dangerous than convenient.

mooism2 17y ago

It's at the intersection of security and user experience. Changing your password because you think it's been compromised is a different use case from changing your password because you've been using it for years or forgotten it.

cgranade 17y ago
At the risk of encouraging Yet Another Warning, would displaying a notice after changing passwords that sites are still authorized be a solution? I'd say that it should have links to more info and to the Connections page, but I despair of users giving up at any sign of warnings. As looking at the issues with that infamous little "lock" icon to indicate HTTPS shows, security and UX intersections are always difficult.
- mooism2 17y ago
  Possibly display a list of recently authorised sites (and when they were authorised), and make it easy to revoke them without going to another page. It's difficult because people don't expect another step after they've changed their password, and (I'd guess) wouldn't immediately understand the need for it. Perhaps the answer is Yet Another Configuration Setting: the default option revokes all site authorisations when you change your password; the alternate option allows (but forces) you to think about it.

kwamenum86 17y ago

Many people cannot understand the difference between a browser and an OS or the difference between Firefox and IE. How can we expect them to manage their OAuth tokens? When OAuth was first writtes many SITES did not even have it implemented correctly (Myspace is a notable example.) In general, having the average naive user administer any aspect of security beyond choosing a "secure" password is a naive expectation. You can't afford to have both parties acting naively when it comes to Internet security. For this (non-naive) audience, managing OAuth tokens makes sense and Twitter can afford to be naive. For the rest of the Internet audience this approach is probably more dangerous than convenient.