That's not a drive-by hijack, all bets are off when it comes to apps. For all you know the app is presenting a fake login dialog.

It would be a drive-by hijack on the web because there's a good chance you're already authenticated with Twitter and the callback cycle will automatically grant credentials on your behalf to the requester with no prompt.

Right - we were discussion OAuth in the context of client apps.

Fair enough. I was referring to the larger discussion.