Subject: [OAUTH-WG] Twitter signature delegation use case

From: David Recordon <[email-masked]>
Date: Fri, 12 Mar 2010 12:42:21 -0800

Was catching up with Raffi from Twitter yesterday and he pointed me to
http://mehack.com/oauth-echo-delegation-in-identity-verificatio.  PDF also
attached.

---

From: Brian Eaton <[email-masked]>
Date: Mon, 15 Mar 2010 16:19:29 -0800

On Fri, Mar 12, 2010 at 12:42 PM, David Recordon <[email-masked]> wrote:
> Was catching up with Raffi from Twitter yesterday and he pointed me
> to http://mehack.com/oauth-echo-delegation-in-identity-verificatio.  PDF
> also attached.

My read is that this is basically creating temporary passwords for users.

It works well when if all of the twitter relying parties trust each other.

It doesn't work if they don't trust each other (in the same way that
sharing passwords with sites that don't trust each other is bad.)

Have I understood it properly?

Cheers,
Brian