5 ms·
Maybe I'm missing something but isn't every single "social login" effectively using OAuth for auth?
by pluma 10y ago
Maybe I'm missing something but isn't every single "social login" effectively using OAuth for auth?
- homakov 10y agoYes. Some apps without sensitive info can do it, but that's it.
- pluma 10y agoSo in other words StackOverflow etc (i.e. all non-trivial apps that support third-party login via OAuth) are all broken from a security POV?
- homakov 10y agoIn one way or another. Most are vulnerable to bugs in standard (see sakurity.com/oauth) but every single one depends on central authority which is just stupid for auth.