4 ms·
The Stack Overflow question I link to offers an interesting point: OAuth would work fine if tokens and secrets were passed out on a per-app, per-install basis.
by AshFurrow 14y ago
The Stack Overflow question I link to offers an interesting point: OAuth would work fine if tokens and secrets were passed out on a per-app, per-install basis. That way you could ban a developer of an app, or an individual, if their token/secret combo becomes compromised. Something like federated key management: http://www.scmagazine.com/federated-key-management-as-the-basis-for-secure-cloud-computing/article/158089/ http://www.scmagazine.com/federated-key-management-as-the-ba...
- bri3d 14y agoThe problem is that to do per-install tokens, one needs a secure side channel between the server and client over which to exchange these tokens, or a secure side channel to some kind of key management/federation server. That's fine and good, but it completely defeats the point of OAuth 1, which was to provide a request signing method that didn't depend on any other secure side-channels to operate. With OAuth 2, of course, the point is mooted a bit by the decision to go with HTTPS as the secure channel, and such a scheme seems much more plausible.