DISQUS

esjewett · 11 months ago

Looks to me like they are describing using a GET request to the API to load some JSON into the browser. I don't think this will work for POST requests, so the friend deletion probably won't work. I assume they don't use XMLHttpRequest because the cross-site request will fail, as it should.

I don't think this is really a huge deal. It probably does raise a valid concern about privacy using HTTP basic authentication on an API in general, since one could use this to access the status messages of a user with a non-public timeline. If I understand OAuth (and I've had a bad week on that front), it would help with this problem because the javascript on the non-Twitter site wouldn't have access to the proper token value to access the API. However, Twitter would have to stop allowing Basic authentication for the API entirely to avoid what we see in this example and I don't see that happening in the near future.

topperge · 11 months ago

I can do a post on a JSON request through jQuery pretty easily. You're right that I can't do it with XMLHTTPRequest and missed that point in my slumber last night.

I agree that OAuth helps the problem because it'll prompt me to agree to authenticate the site to use the different pieces of the API, but the average user is going to check all the boxes and not think. If I decide to be a malicious developer I already have the authorization to modify your account privs.

There has been some big discussions on the Twitter developer group about adding OAuth which they don't think will really solve the problems. As with anything security related its always a cat and mouse game and the standards are ever evolving. The next step in the process is going to be risk and pattern based profiling presenting people with secondary forms of authentication when they fall out of the box.

Jake · 11 months ago

Twitter's had a bad week, but let's face facts. Facebook is in a worse predicament with FB Connect. Neither system has a very solid authentication system, but now that FB Connect is spreading your creds all over the 'tubes, I think it's time to step up the difficulty factor and make it tougher to break into an account.

We all hate remembering strong passwords, but that's a start, no?

topperge · 11 months ago

It's really getting interesting in the online authentication space. The Commission for Cybersecurity just released an interesting "Recommendations for the 44th Presidency" found here: http://www.csis.org/component/option,com_csis_p...

Some of the things they call for is a national online authentication system either public or private and companies who don't comply will have to assume a higher level of risk (i.e. be charged more for transactions) online.

One of the best demos I've seen for OpenID had a one time use SMS message tied to authenticating a new account. The use case was that you could use your username and password over and over again for sites you've authenticated to in the past, but as soon as you try and authenticate to a new site they sent a text message to your phone with a unique password to make sure it was you. They also profiled where you logged in from i.e. an OSX machine through Firefox in Portland between 7am and 12pm. When you fell outside your normal range through a configurable set of factors it would send you a one time use password again to authenticate that new machine / profile to your account.

They also gave you other less secure means if you didn't have a cell, or it was dead that you could use to override the system. Really cool stuff.

(OK, enough IdM geekery)

Jake · 11 months ago

I remember we talked about that profiling piece, which would be acceptable to secure my creds. It's creepy, but if I trust an OpenID provider, I want them to keep my crap secure.

Trust is the issue though. The big networks (MySpace, FB), and the ones with high profiles (LinkedIn, Twitter) will see this problem get really bad, really fast, if they don't act quickly.

Google is another ID vendor that needs to get its act together quickly; their OpenID support isn't moving fast enough.

This is one area where enterprise pwns consumer web.

topperge · 11 months ago

The twitter and OAuth discussions heat up:
http://simonwillison.net/2009/Jan/2/adactio/
Alex Payne is the chief architect for Twitter.

Jake · 11 months ago

Yeah, I know the name. This is good. Twitter isn't alone here; FB probably has a worse predicament on their hands as FB Connect spreads. I'd wager that FB has the lowest level of technical proficiency among its users, making it a prime target for phishing.

It's going to be interesting to see how all this plays out as the shiny, happy API days fade.