Hacker News Reader

Comment by nelhage | Hacker News Reader

> So what Twitter is asking for is that in order to authenticate a user (with additional credentials) you give them a valid "user agent" that was assigned by Twitter.

No. What Twitter is asking for is that you keep that "user agent" secret, even though you have to distribute it to everyone who uses your app. And they have demonstrated that they will happily block that user agent value if you don't do so.

I would be perfectly happy identifying my app to Twitter, and I'm more than happy using OAuth -- it's technically a much better choice than plain passwords. I'm not happy that I have to fulfill an impossible requirement or have my app disabled, and more so that that requirement isn't applied to Twitter themselves or to the other large players they have partnerships with.

View on HN

If they're relying on that "user agent" key for anything important they're asking for trouble.

This really isn't much different from other OAuth providers eg Ebay. Maybe twitter is more explicit in asking that the user agent is kept secret, but many other providers ask the same thing implicitly, and are just as likely to shut off your app if others spam on your user agent.

And yes Twitter is just like thousands of companies that have come before them that pay lip service to partnering companies.

If someone spoofs your user agent and sends a ton of traffic to Twitter, what would you rather they do?

It's like when someone spoofs your credit card - the bank blocks it, and sends you a new one. Inconvenient, yes - but better than the alternative.

If someone spoofed my user-agent and was spamming with it, and they blocked it, I would be annoyed, but I hope I would be understanding that they were doing what they need to maintain their service, and I was unfortunate collateral.

When they pre-emptively ban my user-agent because someone might steal it and spam with it, but don't apply the same rules to themselves and their partners, then I get annoyed.

The important point here is that your app is open-source and you chose to distribute the keys with the source code, rather than require each person who builds it from source to get their own API keys.

I think Twitter's position - that you should not have done this - is completely reasonable.

Out of curiosity, can you not automate the acquisition of the key, so that when somebody runs your app the first time, it goes and obtains the key as required?

Reply on news.ycombinator.com