4 ms·

Well, there are different layers of trust. I trust the intent of many app developers, I just don't trust their competence to store my credentials securely. So

by zmmmmm 16y ago

Well, there are different layers of trust. I trust the intent of many app developers, I just don't trust their competence to store my credentials securely. So OAuth still requires me to trust their intent, but does solve the problem of competence (as long as I trust them to implement OAuth properly which can also be an issue).

mnutt 16y ago
And that's exactly what xAuth is. It just drops the pretense that oAuth inside a developer-controlled webview is trusted, authenticates directly using email/password, and then stores a token like oAuth.
- zmmmmm 16y ago
  When implemented using a contained web view I agree, it's not terribly useful and arguably even harmful. However if the user is directed through the real browser then they can clearly see where they are logging in and doing the authorisation. This is partly just a problem with iOS and it's limited ability to flow and pass data between apps than OAuth per se.
ceejayoz 16y ago
OAuth is storing credentials, it's just an access token rather than a password. The end result is the same - they have access to your account until you revoke it, either by canceling the token (OAuth) or changing password (non-OAuth). Clients using xAuth don't store username/password, anyways. They just use it once to request a token, every future request is just like normal OAuth.
- zmmmmm 16y ago
  > it's just an access token rather than a password. The end result is the same No, its dramatically different. If someone has my password then they have full authority over my account right up to and including changing the password itself. If they have an OAuth token they have whatever limited rights I granted to the token (could be read only, or limited to a subset of data, or automatically expiring after 24 hours). The analogy that is often used is the special set of valet keys that come with some cars. They allow someone to drive the car - but no faster than 20mph, cannot use stereo, etc. etc.

by zmmmmm 16y ago

mnutt 16y ago

And that's exactly what xAuth is. It just drops the pretense that oAuth inside a developer-controlled webview is trusted, authenticates directly using email/password, and then stores a token like oAuth.

zmmmmm 16y ago
When implemented using a contained web view I agree, it's not terribly useful and arguably even harmful. However if the user is directed through the real browser then they can clearly see where they are logging in and doing the authorisation. This is partly just a problem with iOS and it's limited ability to flow and pass data between apps than OAuth per se.

ceejayoz 16y ago

OAuth is storing credentials, it's just an access token rather than a password. The end result is the same - they have access to your account until you revoke it, either by canceling the token (OAuth) or changing password (non-OAuth). Clients using xAuth don't store username/password, anyways. They just use it once to request a token, every future request is just like normal OAuth.

zmmmmm 16y ago
> it's just an access token rather than a password. The end result is the same No, its dramatically different. If someone has my password then they have full authority over my account right up to and including changing the password itself. If they have an OAuth token they have whatever limited rights I granted to the token (could be read only, or limited to a subset of data, or automatically expiring after 24 hours). The analogy that is often used is the special set of valet keys that come with some cars. They allow someone to drive the car - but no faster than 20mph, cannot use stereo, etc. etc.