Guys, here's a basic question: if we implement an authentication from scratch,
as is the case in iwhd, what does 2-legged OAuth buy us that Basic would not?
It is my understanding that although Basic is quite weak, 2-legged OAuth
does not offer a protection from any new attacks, despite offering a timestamp
and nonce. It can still be replayed, if used without SSL, right? I mean, if
the replay is offered fast enough. So, why is there a tilt towards OAuth?
Is there a commonality with 3-legged OAuth that we want to exploit? Or what?
-- Pete