[twitter-dev] Re: OAuth Authentication - clarification needed

[djMax]

If this is true, this is broken from a security perspective, IMHO.
Basically it says that if anyone guesses an oauth_token, they can
login to any site without having any idea who the user that maps to
that token is.