Recently members of the UK HE community asked “why TwapperKeeper was requesting READ / WRITE access when trying to opt out of being archived?”
Recognizing that many people are concerned with 3rd party web applications having having WRITE access to their Twitter accounts, we paused to think a little about our implementation of OAuth – and why we were asking for READ / WRITE vs. simply READ.
Stepping back in history, early users of TwapperKeeper may remember that originally we did not require logins to create archives. This was done to allow for a frictionless way of creating archives, and minimized the need to create an account management solution or try to validate users with basic auth (pre-OAuth days). It simply wasn’t important to know who the user was.
However, as we began to roll-out new features in partnership with JISC and UKOLN, it became more and more important to identify the user (for example, to confirm who was creating an @person archive, to confirm who is requesting to opt out of archiving, etc).
That led us to implementing an application wide OAuth login for the user – which we just happened to set to a READ / WRITE request.
However, upon review of current features, we are technically only using OAuth to identify the user (i.e. get your screen_name) – and really never use the OAuth tokens to READ or WRITE anything on behalf of the user (honestly, we don’t even store the tokens, because we really don’t need them at this time).
Therefore, we have decided to go ahead and reduce the permission to READ at this time. (The lowest level.)
In the future, this decision may need to be revisited as additional features are added that require WRITE access (i.e. for instance the cool features of Twitter @anywhere require READ / WRITE to be turned on) – but it is best to keep the permission at the lowest level required for operations at this time.