On: Compromising Twitter's OAuth security system

[dododo]

i agree it makes sense for web apps.

but for apps installed in developer-untrusted environments, using app keys (and requiring their "protection"--good luck with that) is reminiscent of the dvd/bluray shenanigans.