Long-Lived Desktop Chat Application OAuth Token Secure Storage

[BarryCarlyon]

@TinaTiel

Seems like for the purely desktop app (no remote server deployment available, like in your case), no-matter-what something secret gets stored – be it code grant with client secret & refresh token, or implicit with a long-lived token – something will be stored on the broadcaster’s PC.

if the “Secret” in this case is the users own token.

Then it is perfeclty fine to store the users own token, in the desktop app, since it’s the users token.

For implicit auth you wouldn’t be storing anything “secret” clientSide.

And like you say

@TinaTiel

Attack-vector-wise, compromising a secret or a long-lived token could have the same consequences, though at that point an attacker would have access to the broadcaster’s PC and could do lots of other damage

If they “won” the users PC, they can jsut grab the first party token, that is being used to talk to the Twitch website (via chrome) rather than looking for some misc program like yours. (Easier to go after a known attack vector/likely installed program than looking for misc apps like what we make)

@TinaTiel

Only hesitation I have with implicit is that it’s not recommended wider-speaking anymore so I expect Twitch to eventually kill it at some point?

Yeah I read that somewhere else recently. I don’t think there are plans to 'nix it.

And if they do, they are probably gonna replace it with PKCE like the linked uservoice you linked already. or (hopefully) follow whatever the RFC recommends.