On 1/18/2010 8:57 PM, Marc Mims wrote:
* John Meyer<john.l.me...@gmail.com> [100118 19:38]:
But you still control your own keys. If you find that somebody has
compromised your program, you can revoke those consumer keys through
twitter and regenerate them.
That isn't reasonable. If my desktop app has 10,000 users, and one user
extracts and uses the consumer key pair, regenerating a new pair and
distributing them is a huge burden on the developer and the 9,999 other
users. And that single malicious user will have the new pair extracted
and in use before you can finish pushing out the update.
Like I said earlier, Twitter needs to revoke access for malicious
activity per user, not per app.
Which would probably have its own feasibility problems. If I'm a
malware producer, for instance, I'm not just going to compromise one
user account with one consumer keypair. I'm going to compromise ten