I signed up to TweetDeck, and following the steps it appears that I issued it an OAuth token.
Then I installed it (0.35.1, Linux), signed in with my TweetDeck account and tried to add my Twitter account. It then asks me for my Twitter Password.
Why would it need my password if it uses OAuth?
I received an email from Twitter a while after authorising the OAuth token. It suggests this is common to apps in general and not just TweetDeck:
- OAuth is a technology that enables applications to access Twitter on your behalf with your approval without asking you directly for your password.
- Desktop and mobile applications may still ask for your password once, but after that request, they are required to use OAuth in order to access your timeline or allow you to tweet.
I still don't understand why they would need my password if I've already authorised an OAuth token directly with Twitter via the web.
The email also says:
Applications are no longer allowed to store your password.
How they could be prevented from storing it? Revealing a password "once" is revealing it forever.