Passwords Stored In Clear Text

Agreed. Some MySQL encryption methods: http://dev.mysql.com/doc/refman/5.1/en/encryption-functions.html.

But for most of these, you have the private key storage issue -- is it safe to hard code it in the module? If I had time or was more familiar with module development, I'd take a further look at it, but maybe the above link is a place to start?

since we want something simple that doesn't rely on DB-specific functions how about PHP base64_encode/base64_encode? It's not MD5 or anything but it is one step above storing
in cleartext.

http://us2.php.net/manual/en/function.base64-encode.php
http://us2.php.net/manual/en/function.base64-decode.php

Security through obscurity like base64_encode is pretty useless. I think we should close this in favor of something like #404470: Authenticate Twitter_Actions.module via OAuth.module 2.x instead of Basic Auth.

Agreed. Base64 is essentially rot13; it will stop a well-intentioned administrator from accidentally seeing your password while skimming through the database, but does nothing to stop someone who actually wants it.

I'd like to look into https connections for the 2.3 release, but long-term OAuth is the 'secure authorization' mechanism twitter.com has decided to go with.

We are looking at using the Twitter module to connect to a StatusNet deployment behind our corporate firewall. For us, OAuth wouldn't be an option. Both Drupal and StatusNet are integrated with LDAP, so users log onto both sites using their corporate intranet credentials. We can't allow those credentials to be stored in clear text, or allow them to be stored outside the firewall.

One option would be for the Twitter module to add a password field to the node edit form for the relevant content type. It could do the API authentication over HTTPS -- and not save the password. This would add a small burden for the user but would make the module acceptable in a situation like ours. (I think -- I may not be clear on the security implications, so please let me know if you think this wouldn't have risks I might not be aware of.) I guess this is a feature request, but it's also a request to consider scenarios other than posting to Twitter from an internet site. Thanks.

@stjout - this issue is closed as a duplicate. If you want an additional feature to enhance the security then I think the answer is that it absolutely can be done but it should be a new issue.

For visibility you should state the specific goals of your feature (your comment reads to me like criticisms and motivation, but not a goal - we need goals). Perhaps then come back here and link to your issue so those people who are interested in the topic can move from this thread to your new one.

Ouch. I don't mean it as critical in any way. The module is great, and wonderful to have. I just meant to note that it's potentially very useful in scenarios that weren't part of the discussion. At your suggestion, I've create a feature request here: http://drupal.org/node/789718 -- please let me know if that request could use more/different info to be a useful goal. & thank you!