I woke up this morning to the apparent viral spread of the TweetCloud app that unoriginally, but very nicely displays your most tweeted words of the year, or month, or .. you get the idea. Here's mine ->
Two things happened today that inspired me to write this post tonight.
Facebook and Twitter both offer authentication services arguably known as "single sign-on". Facebook Connect is a proprietary system, and Twitter offers a system based on the OAuth standard. These services do something quite marvellous – They allow you to authenticate with a another website without the third party ever seeing your password. What's makes it even more handy is that you're probably already signed in to these popular services, so you may not need to enter your password at all. The problem is when you do.
I noticed some weeks ago that Twitter's OAuth implementation didn't appear to be verifying signatures. I knew this because I purposefully set an invalid access token which was accepted unconditionally. I thought this was odd, but as a newbie to OAuth I was just happy that my app was working, so I filed the problem at the back of my mind under "deal with it if it becomes a problem". Today (the week I release by beloved TwitBlock app) it very suddenly became a problem.