Comment 9 for bug 627871

The current implementation does frame the Twitter website. The risk is a phishing risk: Gwibber could very well be pretending to display the Twitter website but not actually displaying it.

Anyway, I suppose if xAuth was not granted and Twitter is being such a PITA about it (which I'm glad Ryan Paul has commented on [1]), this method isn't worse than the previous one, and Gwibber can't really help it. Good to know it is being actively looked at, so that if Twitter was ever to fix its progress, Gwibber would adopt it (I suppose).

[1] http://arstechnica.com/security/guides/2010/09/twitter-a-case-study-on-how-to-do-oauth-wrong.ars/