4 ms·
> OAuth is an authorization system, not a mere authentication system You're right. Sorry for my sloppy use of AuthN and AuthZ. My point is that for day to da
by mgreg 11y ago
> OAuth is an authorization system, not a mere authentication system
You're right. Sorry for my sloppy use of AuthN and AuthZ. My point is that for day to day authentication into 3rd party sites which is what I think most people use "Sign in with Google" and the like for might be better served by a 3rd party with less or no data. Less chance of accidents like the subject of this HN thread.
Of course as others have suggested Google could implement a more serious authorization system for elevated or unusual privileges in order to get users, such as this one, to pay attention.
- dragonwriter 11y ago> My point is that for day to day authentication into 3rd party sites which is what I think most people use "Sign in with Google" and the like for might be better served by a 3rd party with less or no data. Or just an AuthN-only protocol, like OpenID.