Flow to add Twitter account to personal settings: Don’t require tweet for confirmation

[jancborchardt]

Our confirmation process for adding a Twitter account right now requires anyone who wants to add their account to their profile to send a tweet with a small random string. This might be good cause we don’t need to trust the server and seem nice as advertisement, but sending a message out is a very high barrier to entry.

Yes, Keybase does it too but Keybase is also a nerdy tool. Less techy people are very skeptical of posting stuff like this in their stream. We should look into alternatives like doing it via OAuth or similar.

Ref #1946 @schiessle

[rullzer]

Well there is no real other way to validate usuing a public medium.

You need to have something public to check if the twitter handle really belongs to a user. (And the other way around).

Also even if we would trust twitter. They don't provide a service to validate this.

It is not ideal from a low barrier point of view but we need to make sure the user has access to their account.

Probabaly the best solution is something like tweet this:

'I'm using Nextcloud! If you want to share something with me use -- '

The hash part is actually the important part. We could of course make this look fancy like use 6 random emojis or whatever. Or we could phrase this differently. As long as we can verify it.

[jancborchardt]

Closing as per @rullzer’s comment. :)