|
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
 |
From: Dossy Shiobara <do...@panoptic.com>
Date: Fri, 17 Apr 2009 19:05:02 -0400
Local: Fri, Apr 17 2009 7:05 pm
Subject: Re: [oauth] Re: http://apiwiki.twitter.com/Sign-in-with- Twitter
On 4/17/09 7:00 PM, John Kristian wrote:
> OAuth concentrates on securing communication between the consumer and Oh, I don't care about transmitting sensitive data via the OAuth > service provider. The callback is just a timing signal, telling the > consumer it can continue its interaction with the service provider. > Nothing sensitive is transmitted via the callback. > In other words, attempting to transmit something sensitive via an callback. I just want to eliminate replay attacks - you're absolutely right, the callback is a form of IPC to the consumer ... which presumably will go on to perform other tasks once it receives the signal. Depending on what those tasks are, it's very desirable to be able to tell if the callback was legitimate or either a replay attack or a brute-force token shooting attack. Even client-side browser cookies may not win here if a simple session Exactly what's the harm in signing the callback URL? -- You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
| |||||||||||||