I have seen a couple of webapps that say something along the lines:

"Use your twitter account-> User ___ password __"

And then they take you to some other page.

After all this phishing warnings and all, why should I trust in one of those apps?

4 Answers 4


What sites should do is use twitters oAuth to sign in, it will redirect you to twitter where you will be asked if want to share details (never your password). External sites will soon no longer be able to sign users into twitter using a username and password so behaviour like this will soon be going the way of the dodo.

To see it in action, I have built a site for the stack apps api that uses twitter oAuth called stack of twits.

  • +1 for oAuth. Worth mentioning that Basic Auth (asking for a username and password) will become obsolete come August 16, 2010
    – Ian
    Jul 8, 2010 at 9:19
  • 1
    I have seen sites like yours ( using oAuth ) but I think something has to be done in the user experience from the twitter side. I mean, we have spent several years training our users, not to put user/password on an application that looks like the real. I know, that I have to look at the address to verify, but it would be extremely easy to create a phishing site with something like: twitter.oauth.com/yadayada with the same look and feel.
    – OscarRyz
    Jul 8, 2010 at 17:32

You shouldn't.

A site that wants to let you use your personal credentials should have an OpenID integration like webapps.stackexchange.com (or the other family members).

Asking you to enter your credentials, even if without evil intent, is inviting trouble.


Always prefer OAuth logins - these direct you to Twitter to login and authorise the site (much like Facebook connect). But it can sometimes be difficult to be absolutely sure that it is Twitter you're sending the password to - especially if the site opens the OAuth page in an iFrame or similar.

Also - even if the site is using OAuth it can still be up to no good.

So you'll have to make a judgement call on whether you trust the site.

Update: An example of OAuth sites that can be up to no good: Twibbon does some bad stuff (that they put in their smallprint).


Since twitter has a method of allowing sites to use your twitter account with other sites (without giving out your password), sites that do ask for your login details are most probably fraud.

  • No this isn't strictly true. It was a legitimate way to integrate with twitter for a while. They are phasing it out currently, but it is still a valid (if insecure) way of authenticating with twitter. I would still be wary as it is stupidly easy to use oAuth so I'd be suspicious of the quality of the website and/or the devs.
    – johnwards
    Jul 8, 2010 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.