I agree with Duane... A lot of us have implemented oAuth on Twitter's strong urging and continue to be "punished" for it by none other than Twitter... Of course consumers will prefer clients with the easier log in flow, giving unfair benefit to apps that just request the un/pw instead of redirecting to Twitter (realize that though we all know that it's not advisable to give your Twitter credentials to a third party site, however 90% of the consumers out there wouldn't think twice about it and will make their choice based on ease of use). And secondly, yes I am a broken record on this topic, the inability to consume or provide 3rd party APIs from/to apps that rely on oAuth, as delegation isn't supported (though Raffi confirmed this morning that sometime between now and when hell freezes over, Twitter will provide a solution to this).
If it's now Twitter's stance that it's okay to ask your users for their Twitter un/pw, then let's all switch to that immediately... It'll allow me to consumer and/offer 3rd party APIs, I can use basic auth for the next 6.5 months, and then switch to this proposed fake oauth in June by requesting tokens using the user's username/password... On 12/10/09 10:40 AM, "Duane Roelands" <[email protected]> wrote: > Many of us in the developer community have been strongly pushing the > point of view that third-party apps should never be asking for user > credentials. We did so because we believed that Twitter was firmly > committed to the security of the ecosystem and protecting the accounts > of its users. It now appears that this belief was in error. > > This decision is going to actively hurt developers who chose the > more secure implementation. Application A just lets me log in with my > Twitter credentials, but Application B wants me to go through this > harder process. Most users will choose option A, and the more-secure > application B loses users. this decision punishes developers who > chose the more secure model. It's disappointing, because a lot of > developers have worked very hard to bring OAuth implementations to the > community that were robust and secure and **didn't require a user to > hand over their Twitter credentials**. > > There was a great opportunity here for Twitter to be a security leader > in the social network space by saying "We don't want our users giving > their Twitter credentials to anyone except Twitter". It's a shame > they didn't stick to their gun; the result is going to be a less- > secure ecosystem.
