3 ms·
OAuth (1) requests are signed with a combination of access token and shared secret. I can't impersonate you (as a user) just by sucking the OAuth secrets out of
by cheald 14y ago
OAuth (1) requests are signed with a combination of access token and shared secret. I can't impersonate you (as a user) just by sucking the OAuth secrets out of the app.
OAuth 2 requests are identified by a bearer token, and have no shared secret signing.
- AshFurrow 14y agoThanks for the info - I've updated the post according to your feedback. I think this is more an article discussing why you shouldn't use OAuth 1 when OAuth 2 is available.
- cheald 14y agoWith all due respect, it needs some work, then. You've framed it in the context of security, and there's been no compelling reason presented for as to why OAuth 1 is an inferior solution to OAuth 2 from a security perspective. Both use access tokens. OAuth2 has implicit flow, which serves to keep my server-side client secret out of the hands of mobile users, and which I can achieve in OAuth 1 by using a separate client secret for my mobile distribution than I do for my server distribution. At the end of the day, all information on the client is subject to compromise. Period, paragraph, end of story. Any identification system that relies on a shared secret is subject to compromise as long as that shared secret is stored on a client-controlled device or ever entered into memory. That's true for OAuth, OAuth2, basic auth, pubkey authentication, passwords, biometrics, and literally every other single-factor identification scheme on the planet.