[ Gunther ] ‏@Gunther_AR Dec 14

@homakov Interesting trick sir.

DaKnOb ‏@DaKnObCS Dec 14

@homakov @l33tdawg I discover this over a year ago and none bats an eye.. :P

Egor Homakov ‏@homakov Dec 14

@DaKnObCS disclosure post? what twitter said btw?

DaKnOb ‏@DaKnObCS Dec 14

@homakov Twitter declared it a feature added originally for SMS and then left on web version

Egor Homakov ‏@homakov Dec 14

@DaKnObCS do you understand where the vulnerability is? That oauth apps can send DMs w/o permission to do that

DaKnOb ‏@DaKnObCS Dec 14

@homakov I know. I told them. They said it is a Twitter feature and should be left as is

DaKnOb ‏@DaKnObCS Dec 14

@homakov More specifically an employee told me “OAuth DM permission is for read access”

Egor Homakov ‏@homakov Dec 14

@DaKnObCS WTF. Are they crazy. so, technically, Write access to /direct_messages should come by default with timeline access

Egor Homakov ‏@homakov Dec 14

@DaKnObCS this feels so broken isn't it. Like texting your friends about borrowing money, which is not what apps should do. omg

DaKnOb ‏@DaKnObCS Dec 14

@homakov I was told DM access is only needed to read. (I reported this like 10 times hoping one will get through)

Egor Homakov ‏@homakov Dec 14

@DaKnObCS that's fun! now i don't feel any sadness about full disclosure because those guys seem crazy :|

DaKnOb ‏@DaKnObCS Dec 14

@homakov That’s what I thought. I discovered it by accident as I was messing with the API and I couldn’t figure out what *I* did wrong :P

Egor Homakov ‏@homakov Dec 14

@DaKnObCS hah, so you fuzzed "d name text" good job. I wonder if they have other commands built in

DaKnOb ‏@DaKnObCS Dec 14

@homakov Not as far as I know, but what stops you from trying the entire alphabet and figuring out the arguments? :P

Egor Homakov ‏@homakov Dec 14

@DaKnObCS why, i will end up with "it's a feature" anyway :D

Ben Ward ‏@benward Dec 14

@homakov @DaKnObCS In our model, the DM permission exists to ensure a user gives explicit consent for apps to *read* their messages.

Ben Ward ‏@benward Dec 14

@homakov @DaKnObCS Although the copy isn't explicit, Sending a Tweet and sending a DM are equivalent (and as you found, they're interwoven.)

Ben Ward ‏@benward Dec 14

@homakov @DaKnObCS The crux is: A user should not have to give an app permission to read their private DM inbox just so an app can send a DM

Egor Homakov ‏@homakov Dec 14

@benward @DaKnObCS from chats with people all o them find this "feature" illogical, maybe company could mind explaining why it's "built in"?