3 ms·
No, that's not exactly what he means. The "token" isn't the OAuth native token, it's a 6-digit code that is based on the current time and a device secret embedd
by sirclueless 15y ago
No, that's not exactly what he means. The "token" isn't the OAuth native token, it's a 6-digit code that is based on the current time and a device secret embedded in the app on your phone.
- lobster_johnson 15y agoWhat you are referring to isn't part of the OAuth spec, as far as I know, is it something particular to Google's API? The cached access token could also be considered a factor, although it depends on the token expiry policy. If the token doesn't require a refresh using a refresh token (which must prompt a password) often enough its security is compromised. I don't know what kind of expiry Google's OAuth token has, but last time I tested this, it was a very long time. I believe Twitter's live forever. Facebook's offline access scope (which you will need for a normal app) lives forever until the user changes his/her password (see http://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/ http://developers.facebook.com/blog/post/2011/05/13/how-to--...).
- lobster_johnson 14y agoOh, I see, it's actually an app you install on your phone.