I love OAuth 1.0 in conjunction with RSA signatures (even though OAuth 1.0 left key exchange unspecified). With RSA, you never need to store a shared secret on

I love OAuth 1.0 in conjunction with RSA signatures (even though OAuth 1.0 left key exchange unspecified). With RSA, you never need to store a shared secret on either of the three ends and you still get revokable authentication. I'm always terribly afraid of storing something on the server that needs to be in a form in which it's useful for a malicious party to impersonate other users. Be it a clear text (or reversibly encrypted password), a MD5 hashed password stored for HTTP digest authentication or a HMAC-SHA1 OAuth token. I know it might seem complicated, but authentication - especially once a third party gets involved is complicated. That's why you read into the issue, learn what you need to know and use pre-build libraries.