Re: [twitter-dev] Encrypt access key, secret, or both?

2010-06-02 Thread Matt Harris
Hey Clint, There is a lot of terminology to get your head round so don't worry about asking for clarification. To add to Taylor's comment it may also be helpful to know that the user token and secret you get back is unique to your application. This means that user token and secret won't work with

Re: [twitter-dev] Encrypt access key, secret, or both?

2010-06-02 Thread Taylor Singletary
Hi Clint, No Worries. I'm really not familiar with the way things like the Keychain store and persist these things. I'll be more verbose: You are absolutely safe in storing the "token" part of the user's access token and your consumer key unencrypted. Encrypting both the consumer secret and "se

Re: [twitter-dev] Encrypt access key, secret, or both?

2010-06-02 Thread Clint Shryock
I guess I'm getting terminology confused. My application is a desktop Mac applications. When I registered my app I got a Consumer Key and a Consumer Secret. These belong to my app. For a given user I go though the xAuth process and get back an Access Token, consisting of a key and secret. These

Re: [twitter-dev] Encrypt access key, secret, or both?

2010-06-02 Thread Taylor Singletary
Encrypting your consumer secret is the most important, but encrypting your access token secret isn't a bad idea at all -- I would recommend it. There's no need to encrypt your consumer key and access token though, as they are already either sent as query parameters or within HTTP headers on every