Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I signed up to TweetDeck, and following the steps it appears that I issued it an OAuth token.

Then I installed it (0.35.1, Linux), signed in with my TweetDeck account and tried to add my Twitter account. It then asks me for my Twitter Password.

Why would it need my password if it uses OAuth?


Update:

I received an email from Twitter a while after authorising the OAuth token. It suggests this is common to apps in general and not just TweetDeck:

  • OAuth is a technology that enables applications to access Twitter on your behalf with your approval without asking you directly for your password.
  • Desktop and mobile applications may still ask for your password once, but after that request, they are required to use OAuth in order to access your timeline or allow you to tweet.

I still don't understand why they would need my password if I've already authorised an OAuth token directly with Twitter via the web.

The email also says:

Applications are no longer allowed to store your password.

How they could be prevented from storing it? Revealing a password "once" is revealing it forever.

share|improve this question
1  
Actually it's not revealing it forever if you go and change your password. Sort of a moot point though –  Joe Philllips Sep 22 '10 at 3:44
    
It is revealing that password forever :) which may tell an attacker a lot even if you then change it. –  Ian Mackinnon Sep 23 '10 at 19:20
add comment

2 Answers 2

Why would it need my password if it uses OAuth?

Some twitter application that have not been updated to support OAuth fully can use the xAuth API to obtain OAuth credentials from a username and password. This is only required once per application installation as the OAuth token that it returns does not expire.

How they could be prevented from storing it?

Obviously twitter can't prevent them from storing your password. The terms & conditions of the the twitter API, which must be agreed to get an application OAuth key, state applications are not allowed to store password - as confirmed in your email.

There are no explicit punishments listed for breaking this agreement, but it would almost certainly get your OAuth key revoked which would invalidate every user's OAuth token issued with that key to your application and prevent your from obtaining any more.

share|improve this answer
add comment

First, they cannot technically prevent the application from storing your password.

Now, if they are a well-behaved local application, the password is only processed (or stored) on your computer and sent to Twitter. That is very different from a service provider storing your password on their servers, which is the problem OAuth was originally designed to solve.

Some desktop and mobile applications use xAuth, a method of using a username and password to start an OAuth flow. This is possibly what TweetDeck is doing. Once you have authorized TweetDeck on one computer, you still need to get the other instance connected, so it needs to authorize it again. So, the flow when you use an application (and it's per application installation, not per application), they can take your username and password, get an OAuth token, and store the OAuth token.

Note that entering your username and password in a well-behaved, reputable desktop application running on your computer is no less safe than entering it in twitter.com in your web browser.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.