Not my post but my answers would be: > Is that actually necessary/useful? Yes, removes guessing, incremental attacks and off by 1 errors/attacks. Obfuscation

Not my post but my answers would be: > Is that actually necessary/useful? Yes, removes guessing, incremental attacks and off by 1 errors/attacks. Obfuscation is bad encryption but good policy. > why Oauth instead of just a regular user table, login POST form, and the rest as you describe? Sessions are fixed and can last an indefinite amount of time as an example. But [token based system X for client/server or some kerberos variant for semi-trusted or m2m] will fill this void as well.