Jonathan Rochkind wrote:
> Can you give some details (or references) to justify the belief that 
> OAuth isn't ready yet?  (The fact that Twitter implemented it poorly 
> does not seem apropos to me, that's just a critique of Twitter, right?).
> 
> I don't agree or disagree, just trying to take this from fud-ish rumor 
> to facts to help me and others understand and make decisions.

The problems with Twitter's poor implementation have been compounded
by bad management decisions like switching off HTTP authentication and
an amazing policy on key invalidation, but I agree that's not the
fault of OAuth.

The key point is in the http://bit.ly/c88aa7 that Joe posted: how can
one publish an OAuth-using client that's not easy to impersonate?

Requiring every user to fill out registration forms and cut-and-paste
key strings into a client is not going to fly, so it seems like it
can't be done except on a very locked-down platform, because the
consumer secret is distributed to users' systems in the app.  So you
either ignore the key parts of the 1.0a version (which means that the
standard needs revision IMO, so is not ready yet), or you jump ahead
to the 2.0 draft, which is not ready yet because it's still a draft.

Personally, I think the right answer would have been to keep HTTP
authentication over HTTPS and have some slick way of creating
subsidiary usernames with limited privileges for apps, but there's
probably some better solution that I'm missing.

Aside 1: will 2.0 ever work and be ready?  Its editor Eran
Hammer-Lahav criticises its current state at
http://hueniverse.com/2010/09/oauth-2-0-without-signatures-is-bad-for-the-web/

Aside 2: to be fair, I'll point out that Eran Hammer-Lahav criticises
the ars.technica article at
http://hueniverse.com/2010/09/all-this-twitter-oauth-security-nonsense/
but does mention that "there is no solution [...] for a distributed
application" - does that mean OAuth isn't fit for FOSS?

Hope that helps,
-- 
MJ Ray (slef), member of www.software.coop, a for-more-than-profit co-op.
Webmaster, Debian Developer, Past Koha RM, statistician, former lecturer.
In My Opinion Only: see http://mjr.towers.org.uk/email.html
Available for hire for Koha work http://www.software.coop/products/koha