4 ms·

I must be missing something here. If someone hacks an oauth provider (e.g. Facebook, Google, etc.) and gets my password there does that not mean they can then

I must be missing something here. If someone hacks an oauth provider (e.g. Facebook, Google, etc.) and gets my password there does that not mean they can then log into any service that supports oauth as me at that point? Probably even if I have purposely avoided ever using oauth for anything? How is this different from the vulnerability of using the same password everywhere?

csears 14y ago
Using the same password everywhere means a hacker only has to break the weakest of any service you use to get at all your accounts. Using oauth or any single-sign-on system allows you to put all your eggs in one (potentially) more trusted basket. Your scenario certainly is a legitimate concern, but it depends on how the other services implement account linking. If you create a non-oauth account and then sign in with Facebook, some services will allow you to link the accounts based on your email address matching, others won't. Of course in the case of Google, if someone hacked your account, they would probably also have access to your Gmail and could reset passwords from any other service. So the risk isn't significantly different. As a general rule, I only use oauth SSO on sites that I trust less or care about less than my oath provider.