> I'm confounded that such an attitude can survive in a large engineering organization like Twitter.

I'm not surprised. A bit disappointed, but not surprised.

Have a look at the original OAuth specification sometime. Note how they misuse the word "key" to mean "identifier". I can't imagine that anyone writing a crypto specification wouldn't know that this would be confusing; I think it's more likely that the person just didn't care. Also, there's the fact that the whole thing could have been written as just a way of getting Basic authentication credentials, rather than making up a whole new authentication scheme.

And then there's the hashbang thing...