I’ve been meaning to use blog.docuverse.com as permanent URL for this blog but lazyness held me hostage until now. So, there you have it. Tata!

The obvious solution (pun intended) to Twitter auth problem is OAuth. As Biz wrote, OAuth won’t prevent hacking but should reverse increasingly common practice of third-party software and services asking for Twitter credentials. However, OAuth is a disruptive change, one that will break existing code and force everyone to change over. In this post, I will propose a practical alternative to OAuth that offers smoother transition.

PAuth

The core idea behind PAuth is to continue using password for auth but allow multiple passwords to exist for an account, each potentially bound to specific set of clients and permissions.

The key advantage PAuth offers to fast moving services like Twitter is that no client software change is necessary.

User Experience

1. User wants to use Twhirl but, to enable it, Twitter username and password is necessary.
2. User  signs into Twitter with primary password and proceeds to creates generate a limited password for Twhirl, enabling only the permissions Twhirl needs.
3. User uses the limited password to enable Twhirl.
4. When user stops using Twhirl, limited password for Twhirl is deleted.

Multiple Posters

An interesting use of PAuth is limiting password to post-only. By issuing each poster a post-only password, multiple users will be able to post to a single Twitter account and admin (primary password holder) will be able to ban individual posters at any time without affecting other posters.

Details

Limited passwords should be generated for convenience and security. Since limited passwords are maintained by the PAuth provider and typically copy/pasted over to consumer site/client, it can be longer than usual passwords also.