Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 3 down vote favorite

I have seen a couple of webapps that say something along the lines:

"Use your twitter account-> User ___ password __"

And then they take you to some other page.

After all this phishing warnings and all, why should I trust in one of those apps?

share|improve this question

4 Answers

up vote 8 down vote accepted

What sites should do is use twitters oAuth to sign in, it will redirect you to twitter where you will be asked if want to share details (never your password). External sites will soon no longer be able to sign users into twitter using a username and password so behaviour like this will soon be going the way of the dodo.

To see it in action, I have built a site for the stack apps api that uses twitter oAuth called stack of twits.

share|improve this answer
+1 for oAuth. Worth mentioning that Basic Auth (asking for a username and password) will become obsolete come August 16, 2010 – iAn Jul 8 '10 at 9:19
1  
I have seen sites like yours ( using oAuth ) but I think something has to be done in the user experience from the twitter side. I mean, we have spent several years training our users, not to put user/password on an application that looks like the real. I know, that I have to look at the address to verify, but it would be extremely easy to create a phishing site with something like: twitter.oauth.com/yadayada with the same look and feel. – OscarRyz Jul 8 '10 at 17:32
up vote 4 down vote

You shouldn't.

A site that wants to let you use your personal credentials should have an OpenID integration like webapps.stackexchange.com (or the other family members).

Asking you to enter your credentials, even if without evil intent, is inviting trouble.

share|improve this answer
up vote 3 down vote

Always prefer OAuth logins - these direct you to Twitter to login and authorise the site (much like Facebook connect). But it can sometimes be difficult to be absolutely sure that it is Twitter you're sending the password to - especially if the site opens the OAuth page in an iFrame or similar.

Also - even if the site is using OAuth it can still be up to no good.

So you'll have to make a judgement call on whether you trust the site.

Update: An example of OAuth sites that can be up to no good: Twibbon does some bad stuff (that they put in their smallprint).

share|improve this answer
up vote 0 down vote

Since twitter has a method of allowing sites to use your twitter account with other sites (without giving out your password), sites that do ask for your login details are most probably fraud.

share|improve this answer
No this isn't strictly true. It was a legitimate way to integrate with twitter for a while. They are phasing it out currently, but it is still a valid (if insecure) way of authenticating with twitter. I would still be wary as it is stupidly easy to use oAuth so I'd be suspicious of the quality of the website and/or the devs. – johnwards Jul 8 '10 at 7:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.