Twitter API - Validating Twitter is actually Twitter

Question

I've been looking around at various APIs, and since twitter seems to be a common discussion point, I'll use it as an example.

A lot of APIs are implementing oAuth which is great for allowing the service to authenicate and authorize the application connecting to it, however, from what I have seen there doesnt seem to be a way for the application to verify that Twitter is actually Twitter (and not a man in the middle based attack)? I would expect to see some kind of signature (using a shared / public key) of the response body which I can use to validate that twitter signed it.

Is it just because currently there isnt really a point to a man in the middle attack with twitter tweets since currently, whats the worst that can happen (and why would someone want to give me invalid tweets)

On this point, if you were to sign the response, what method would you use? Im currently considering a HMAC-SHA1 signature of the response body using a shared key.

Answer 1

This is what the 'trust' part of SSL does.

-- Edit

I note this has been downvoted, but it's important that other readers realise it's due to a personal disagreement, not due to incorrectness.

Answer 2

In the .NET world we use WCF, which has many different security models, including signing (and if desired encrypting) each message/response. This adds up to a non-trivial amount of overhead, but can give you more 'trust' in the security model. You can switch to using binary-serialized data to cut down on the bloat and message size if you desire.

I'm not sure what other Web Service APIs offer in that area, though I'm sure someone else can add further details as needed.