Apparently it was the Twitter admin help desk application that was hacked. It's been taken offline. The phishing was separate.
"It will be good for the people calling for more secure, standards based authentication on Twitter and elsewhere around the web." [from article]
"it is important to note that OAuth would not have prevented either of these attacks" [from Twitter]
I see the point for OAuth third party applications, but that's not the attack vector here. That's just free association. What more secure authentication do people want? Client certificates? Dongles?
One of my guesses would have been updates via SMS. I've read it's easy to forge caller ID; if it's as easy to forge an SMS origin-number, and you knew these accounts were set up to allow updates via SMS from a certain number... voila!
"It will be good for the people calling for more secure, standards based authentication on Twitter and elsewhere around the web." [from article]
"it is important to note that OAuth would not have prevented either of these attacks" [from Twitter]
I see the point for OAuth third party applications, but that's not the attack vector here. That's just free association. What more secure authentication do people want? Client certificates? Dongles?