title: OAuth without browser and SSL / challenge-response model
body: <p>We have a plan for developing a mobile application using REST-ful. We want to apply OAuth 1.0a not OAuth 2.0 because we don't use SSL. We also don't want to use web browser (we think PIN-based UX is not friendly). We know it's impossible with normal OAuth flow.  </p>
  
  <p>I am not an expert in security architecture but I google on the Net and see someone has a implemention using a method login like challenge-response model. </p>
  
  <p>If our app don't need to keep username secure and users trust us with inputting their password in our app, can this method being use to exchange access token? Is there any flaw?</p>
  
  <ol>
  <li>After server response unauthorized request token, client begin challenge-response flow.</li>
  <li><p>Client send request to <a href="http://www.example.com/login" rel="nofollow">http://www.example.com/login</a>, with parameter like OAuth require: oauth_consumer_key, oauth_token, oauth_signature_method, oauth_timestamp, oauth_nonce and the additional <strong>username</strong> parameter username="username", the <strong>password</strong> parameter calculated from the user's password (which is stored in server), oauth_nonce with KDF key derive function/hash function. Client calculate request signature with OAuth description but send the request with the parameter username and other required parameters <strong>after omitted the password parameter</strong>.</p></li>
  <li><p>Server check the request and return access token.</p></li>
  </ol>