Question about Twitter API

Question

In the documentation it says the following:

Tokens are passwords Keep in Mind that the Consumer key & secret, bearer token credentials, and the bearer token itself Grant access to make requests on behalf of an application. These values should be considered as sensitive as passwords, and must not be Shared or Distributed to untrusted parties.

Translating this:

Tokens are passwords Keep in mind that the consumer key and the secret, the bearer token credentials and the bearer token itself allow access to make requests on behalf of an application. These values should be considered sensitive as passwords and should not be shared or distributed to unreliable parties.

Source: https://dev.twitter.com/oauth/application-only?lang=ko

I’m wanting the user instead of clicking the button Log in with Twitter using oAuth, he fill out a form with his Twitter data, usuário and senha.

OBS: I don’t want to steal information because it’s not possible...

With everything, if the Token sane senhas, I can get the screen_name and use a crypt, I don’t know if the Twitter uses sha1, so I can recover the password too. If anyone knows, inform here.

Source: https://dev.twitter.com/overview/api/users

I’m right or wrong?

Answer 1

What the documentation wants is that credentials (token, bearer token, secret key...) should be kept only with you, safely. Once this information is obtained you will be able to make requests on behalf of your Twitter app.

Anyone who gets their private key (Secret API) can authenticate users by impersonating their application. As well as that anyone who has the tokens/bearer token can also use them as you wish on behalf of your application. For example, they might post tweets as if your app was posted, without you actually doing it.

For this reason, this information may not be shared or distributed, thus remaining with you only.

---

I’m wanting the user instead of clicking the Sign in with Twitter button using the Uth, it fill out a form with your Twitter data, username and password.

The official public Twitter API only allows you to use oAuth. It is built precisely so that users do not inform their credentials to third parties.

There is no official way to do what you want. What there is is gambiarras. That is to use the private API, the one that twitter uses. I’ve already told you how you can do this. You can reverse engineer in the twitter mobile app, as well as monitor requests made by the app.

On the Twitter website you can simply monitor traffic (browsers already have this feature) and then you will know the endpoints used.

You can try looking for someone who has already done this work, including people who have already made such information publicly available or even libraries in some language that uses the private API.

Once you have the passwords you can get the session cookie, this is almost a "Token", but from the private API. It is usually stored in cookies (or multiple cookies), in case the mobile app API may be encrypted, requiring some reverse engineering to get the keys.

---

NOTE: I do not want to steal information, because it is not possible...

Now, if you ask for other people’s passwords... the phrase "I don’t want to steal information because it’s not possible..." is a mistake. Not only do you have the ability to "steal" your credentials, but other people can "steal your theft".

Once you ask for and receive Twitter passwords you will have the passwords, you have access to such credentials. Even if you use HTTPS, the information is decrypted on your side, at best, and will be stored in "some memory", so you have access.

---

With everything, if Token are passwords, I can recover the screen_name and use a crypt, I do not know if Twitter uses sha1, so I can recover the password too. If anyone knows, report here.

I honestly don’t understand what you mean. The Token is random, generated from your private and public key to the user who authorized your application. They are like a password from the point of view of their secrecy, since both their password and both a Token should not be shared, and just as both grant access to make interactions on their behalf.

Unless mistaken Oauth2 does not use any encryption on Token in itself, only in your traffic, this is done to make the answers faster and even so does not require you to encrypt any Token.

If you want to keep the Token extremely safe the most you can do, in my view, is to use an asymmetric encryption and use some HSM to store the keys.

Answer 2

Yes Tokens are passwords as stated in the Twitter API documentation, it uses Base64 with encoder if I’m not mistaken.

To transfer to form, you should not use Uth as it generates a Token that is passed by $_GET, you will have to find another way to validate your form, remembering that you will have to do for example:

curl_setopt($ch, CURLOPT_URL, "http://www.google.com/");

That’s my opinion, and I’m pretty sure I’m right.

Answer 3

Squeeze f12 on the Twitter login page, go to network, squeeze f5 ready you will see some necessary information.