I don't think the solution is to use oAuth either.<p>I mean, yeah, it's <i>technically</i> the right thing to do.  But it's just shy of impossible to implement, and it presents a goofy user experience to your users.<p>So if all your thing does is post stuff to Twitter on behalf of your users, I think it's probably best to save yourself 40-odd hours of frustration and perplexity, and simply save their user/pass in your database.  It is, after all, just somebody's Twitter account, not their banking credentials.<p>If you're logging into something where money can change hands, then yeah, go nuts and do the right thing.  But not for some throwaway-password site where the worst thing that could possibly happen in the case of a compromise is that somebody whinges about their cat in one of your users' name.