It doesn't want to read your Twitter direct messages.
Here's what's going on. The Twitter API currently has two levels of permission: "read" (can access your data, which includes your tweets and followers even if you have a private account, and unfortunately also your DMs) and "write" (can update your account, including posting new tweets, adding new followers, creating new lists etc).
Most Twitter users were unaware that granting "read" access to an application gave that application access to their DMs. This was a problem. Twitter opted to solve it by introducing a new permission level, "direct messages", which is write-plus-direct-message access. They plan to remove the direct message ability from the "read" access.
To give developers time to fix any apps that this would affect, the switch-over date for direct message access is set to June 30th.
Up until that date, the Twitter OAuth authentication screen includes copy that tells you that the application will be able to access your direct messages until June 30th.
This does NOT mean that the application author intends to access them - it just means that the permission level you are granting gives them that ability up until the cut-off date.
This issue is a big problem for people like us ( http://lanyrd.com/ ) who use Twitter for authentication, because it scares away potential users. At least after the 30th we won't have to worry about the DM clause, but we'll still suffer from users assuming that we're going to tweet on their behalf.
Unfortunately, we need "write" access so that the follow buttons on our site work (Twitter's new JavaScript follow buttons aren't appropriate for our attendee directory because we show 20 people on a page: http://lanyrd.com/2011/europython/attendees/ ) - we also need "write" access for our currently-in-alpha Twitter list management features.
The best solution I can think of would either be finely grained permissions (so we could ask for list and follow access but not send-a-tweet access) or the ability for us to specify a reassuring message to be displayed on the Twitter OAuth screen clarifying our intentions.
The application doesn't access your direct messages, but the bare minimum privileges for authenticated API access is "read only", and that happens to include the _access_ to direct messages.
Comments
Why the hell does this site need to be able to read my Twitter direct messages for me to be able to cast a vote?
It doesn't want to read your Twitter direct messages.
Here's what's going on. The Twitter API currently has two levels of permission: "read" (can access your data, which includes your tweets and followers even if you have a private account, and unfortunately also your DMs) and "write" (can update your account, including posting new tweets, adding new followers, creating new lists etc).
Most Twitter users were unaware that granting "read" access to an application gave that application access to their DMs. This was a problem. Twitter opted to solve it by introducing a new permission level, "direct messages", which is write-plus-direct-message access. They plan to remove the direct message ability from the "read" access.
To give developers time to fix any apps that this would affect, the switch-over date for direct message access is set to June 30th.
Up until that date, the Twitter OAuth authentication screen includes copy that tells you that the application will be able to access your direct messages until June 30th.
This does NOT mean that the application author intends to access them - it just means that the permission level you are granting gives them that ability up until the cut-off date.
This issue is a big problem for people like us ( http://lanyrd.com/ ) who use Twitter for authentication, because it scares away potential users. At least after the 30th we won't have to worry about the DM clause, but we'll still suffer from users assuming that we're going to tweet on their behalf.
Unfortunately, we need "write" access so that the follow buttons on our site work (Twitter's new JavaScript follow buttons aren't appropriate for our attendee directory because we show 20 people on a page: http://lanyrd.com/2011/europython/attendees/ ) - we also need "write" access for our currently-in-alpha Twitter list management features.
The best solution I can think of would either be finely grained permissions (so we could ask for list and follow access but not send-a-tweet access) or the ability for us to specify a reassuring message to be displayed on the Twitter OAuth screen clarifying our intentions.
The application doesn't access your direct messages, but the bare minimum privileges for authenticated API access is "read only", and that happens to include the _access_ to direct messages.
Feel free to peruse the source, if you don't believe it: https://github.com/gwoo/phpneeds