Anyway

The latest Twit­ter pass­word hack did affect me, but for­tu­nately I had already switched to the one pass­word per site philo­sophy. I store all my pass­words in LinkeSoft’s Secret!, along with oth­er inform­a­tion that I want to keep on my com­puter and on my phone in an encryp­ted form. I just wish the Mac ver­sion synced with Android.

One bright spot in the issue was the fact that I did­n’t have to change any­thing in all my apps that use my twit­ter account, since they all have their own tokens, inde­pend­ent of my twit­ter pass­word. OAu­th is usu­ally said to be good since you can revoke access for any applic­a­tion at any time; this was the first time it became obvi­ous to me that the oth­er advant­age is that you can change your main pass­word at any time without need­ing to update any oth­er cli­ent. Can oth­er applic­a­tions that have web access and smart­phone app access please take note?

OAu­th is not neces­sar­ily the easi­est of pro­to­cols to under­stand, or imple­ment, but these days there are lots of lib­rar­ies out there that do imple­ment it. When I teach OAu­th at the XML Sum­mer School, I always recom­mend people use exist­ing lib­rar­ies if pos­sible, to let oth­ers do the hard work of debug­ging all the little details. Anoth­er thing I recom­mend is to get the O’Reilly book “Get­ting Star­ted with OAu­th 2.0” (full dis­clos­ure: they sent me a review copy) to under­stand the con­cepts. You need to know about vari­ous types of tokens and cre­den­tials, and how they fit into the multi-layered authentication/authorization pro­tocol dance for the dif­fer­ent use cases. Once you have a decent under­stand­ing of the con­cepts, then go and read the actu­al spe­cific­a­tion for the details. The spe­cific­a­tion has lots of inform­a­tion in it, but it’s immensely easi­er to under­stand if you already know how the pieces fit togeth­er, and that’s where the O’Reilly book is well worth reading.