And with this one of the huge flaws of OAuth comes to play. OAuth just doesn't work with locally installed applications as it's impossible to hide anything there, but OAuth strongly relies on the client having some secret knowledge (the client token).<p>As long as all clients are equal when using the API, this might go well (minus some malicious clients), but once some clients start to be more equal than others - even more so as the service starts to get to be real jerks - then the whole system will fall down.<p>What we see here is twitter's secrets leaking out (though remember: That's more or less public data as it's technically <i>impossible</i> to hide that info - the server has to know) due to them being jerks giving their client preferential access.<p>What does this mean? For now, probably not much as I can imagine the bigger third-party-clients want to behave.<p>It might however make Twitter reconsider their policies.<p>If not, this is the beginning of a long cat and mouse game of twitter updating their keys and using heuristics to recognize their own client followed by twitter clients providing a way to change the client secret[1].<p>Though one thing is clear: Twitter will lose this game as the client secret has to be presented to the server.<p>Using SSL and certificate pinning, they can protect the secret from network monitors, but then the secret can still be extracted from the client, at which point, they might encrypt it in the client, at which point the attackers will disassemble the client to still extract the key.<p>It remains to be seen how far twitter is willing to go playing that game.<p>[1] even if the keys don't leak out, as long as twitter allows their users to create API clients, an editable client secret is a way for <i>any</i> twitter client to remain fully usable