do-plugins team mailing list archive

[saniac <stephen@xxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

Private security bug reported:

It looks as though the microblogging plugin is authenticating using
Basic Auth and plain HTTP.

This is vulnerable to snooping. For example, my friendly local sysadmin
happened to see my password going past during an audit.

Furthermore, Twitter has deprecated basic Auth and recommends that OAuth
be used (ie a user is verified once, and from then on a token in passed,
not the original password). See http://apiwiki.twitter.com/Security-
Best-Practices#UnencryptedCommunicationnoSSL

At the least the plugin should use the https url to log in. Better, it
should use OAuth.

** Affects: do-plugins
     Importance: Undecided
         Status: New

-- 
Microblogging authenticates with Twitter insecurely
https://bugs.launchpad.net/bugs/515838
You received this bug notification because you are a member of GNOME Do
Plugins Team, which is a direct subscriber.