We don't like it either. I can tell you with confidence that a SSL-based dev.twitter.com will be coming in the future though. If you're sensitive in this area, we still have the "classic" style app management available at https://twitter.com/apps -- doesn't have all the bells & whistles, but gets the job done.
Taylor On Wed, Sep 22, 2010 at 5:35 AM, Nik Fletcher <[email protected]> wrote: > This has been discussed quite a bit previously, and is something the > Twitter folks are aware of: > > http://code.google.com/p/twitter-api/issues/detail?id=1665 > > Cheers > > -N > > On Sep 21, 6:54 pm, ManuelZ <[email protected]> wrote: >> When you register your Twitter app athttp://dev.twitter.com, you get >> an api key, a consumer secret and other awesome goodies. >> >> The secret is necessary so that you can validate signatures of stuff >> coming from Twitter (confirm it's from Twitter) and generate >> signatures for stuff you're sending to Twitter (confirm it's from your >> application). >> >> All application settings are sent in clear text (http) if you follow >> the links on dev.twitter, which is an attack vector: the interception >> of the secret can compromise the app. >> >> (1) It's been puzzling me for a while why the dev.twitter.com/apps (or >> at least the app settings page) is not restricted to https only. >> Granted, Twitter can only be affected through a slightly more >> sophisticated attack (incl. spoofing the app) + they likely have >> efficient ways to reverse damage from one compromised application, but >> as the app developer, you're in a pretty bad spot. >> >> (2) Suggestion: if you go tohttps://dev.twitter.com/appsfor all your >> app settings business, you can protect your secret... with one small >> problem: certificate error: >> "dev.twitter.com uses an invalid security certificate. The certificate >> is only valid for the following names: >> www.twitter.com, twitter.com" >> If anyone from Twitter is listening -- it may be a good idea to fix >> this. >> >> (3) On the bright side, Twitter is way better than Facebook, where >> even if you go to your app settings over https (it works!), it will >> redirect you to http after it's re-generated your key. > > -- > Twitter developer documentation and resources: http://dev.twitter.com/doc > API updates via Twitter: http://twitter.com/twitterapi > Issues/Enhancements Tracker: http://code.google.com/p/twitter-api/issues/list > Change your membership to this group: > http://groups.google.com/group/twitter-development-talk?hl=en > -- Twitter developer documentation and resources: http://dev.twitter.com/doc API updates via Twitter: http://twitter.com/twitterapi Issues/Enhancements Tracker: http://code.google.com/p/twitter-api/issues/list Change your membership to this group: http://groups.google.com/group/twitter-development-talk?hl=en
