If Twitter apps use OAuth why would they ask for my password?

Question

I signed up to TweetDeck, and following the steps it appears that I issued it an OAuth token.

Then I installed it (0.35.1, Linux), signed in with my TweetDeck account and tried to add my Twitter account. It then asks me for my Twitter Password.

Why would it need my password if it uses OAuth?

---

Update:

I received an email from Twitter a while after authorising the OAuth token. It suggests this is common to apps in general and not just TweetDeck:

• OAuth is a technology that enables applications to access Twitter on your behalf with your approval without asking you directly for your password.
• Desktop and mobile applications may still ask for your password once, but after that request, they are required to use OAuth in order to access your timeline or allow you to tweet.

I still don't understand why they would need my password if I've already authorised an OAuth token directly with Twitter via the web.

The email also says:

Applications are no longer allowed to store your password.

How they could be prevented from storing it? Revealing a password "once" is revealing it forever.

Answer 1

Why would it need my password if it uses OAuth?

Some twitter application that have not been updated to support OAuth fully can use the xAuth API to obtain OAuth credentials from a username and password. This is only required once per application installation as the OAuth token that it returns does not expire.

How they could be prevented from storing it?

Obviously twitter can't prevent them from storing your password. The terms & conditions of the the twitter API, which must be agreed to get an application OAuth key, state applications are not allowed to store password - as confirmed in your email.

There are no explicit punishments listed for breaking this agreement, but it would almost certainly get your OAuth key revoked which would invalidate every user's OAuth token issued with that key to your application and prevent your from obtaining any more.

Answer 2

First, they cannot technically prevent the application from storing your password.

Now, if they are a well-behaved local application, the password is only processed (or stored) on your computer and sent to Twitter. That is very different from a service provider storing your password on their servers, which is the problem OAuth was originally designed to solve.

Some desktop and mobile applications use xAuth, a method of using a username and password to start an OAuth flow. This is possibly what TweetDeck is doing. Once you have authorized TweetDeck on one computer, you still need to get the other instance connected, so it needs to authorize it again. So, the flow when you use an application (and it's per application installation, not per application), they can take your username and password, get an OAuth token, and store the OAuth token.

Note that entering your username and password in a well-behaved, reputable desktop application running on your computer is no less safe than entering it in twitter.com in your web browser.