Ripping OAuth tokens out of Twitter apps

Re:Ripping OAuth tokens out of Twitter apps by metoosorta on Monday August 20, 2012 @11:39PM (#4411049)

Oauth tokens, consumer keys, nonces, and timestamps are not something you don't already have access to as a user. The token is your authentication proof / API access key, the consumer key is a bit misleadingly named but just identifies the 3rd party, it is public knowledge. The nonce and timestamps are artifacts of authentication and less sensitive than the token.

The real meat is the 3rd party's consumer secret (the secret key that goes with their consumer key.) If you're finding those then someone needs to make a South Park ski instructor meme.

[ Parent | on HN ]

Re:Ripping OAuth tokens out of Twitter apps by maqr on Tuesday August 21, 2012 @01:24AM (#4411305)

This should be the top comment. This blog post just shows URLs, which are the result of being signed with the 'consumer secret'. You can see the same thing with wireshark, charles, or any other sniffer or debugging proxy.

The more important thing is the consumer secret itself, which is discussed here: http://stackoverflow.com/questions/4419915/how-to-keep-the-o...

[ Parent | on HN ]

Re:Ripping OAuth tokens out of Twitter apps by rmccue on Tuesday August 21, 2012 @02:42AM (#4411435)

You shouldn't be able to see it with Wireshark, given that it's HTTPS, but you should be able to MITM it (assuming you can make yourself a CA, that's trivial).

[ Parent | on HN ]

Re:Ripping OAuth tokens out of Twitter apps by tommoor on Tuesday August 21, 2012 @01:37AM (#4411323)

agreed, this post doesn't show any information you don't have permission to know being the authorised user of the application...

[ Parent | on HN ]