4 ms·
This gives me the creeps. Authorisation and identification are not the same. If you use 'Login with X' you're giving X access to all your accounts. That's not j
by nly 12y ago
This gives me the creeps. Authorisation and identification are not the same. If you use 'Login with X' you're giving X access to all your accounts. That's not just third party attestation of your identity. It's kind of like saying a passport is what gives you access to your home country... in reality your status as a citizen is what gives you that right, the passport is merely a convenience.
- cheald 12y agoAuthorization of a null permission is effectively the same as authentication, though. I think the GP's point was that authz implies authn, even if the set of permissioned authz'd for is empty.
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- nailer 12y agoEdit: see reply below, I think I misunderstood the parent post. > If you use 'Login with X' you're giving X access to all your accounts. That's definitely not correct. You are giving X to access only whatever scopes you allowed, on a single account. Here's an example of just 'userinfo'. Click this and see what it asks for: https://accounts.google.com/AccountChooser?service=lso&continue=https%3A%2F%2Faccounts.google.com%2Fo%2Foauth2%2Fauth%3Fscope%3Dhttps%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile%26response_type%3Dcode%26access_type%3Doffline%26redirect_uri%3Dhttps%3A%2F%2Fdevelopers.google.com%2Foauthplayground%26approval_prompt%3Dforce%26client_id%3D407408718192.apps.googleusercontent.com%26hl%3Den%26from_login%3D1%26as%3D-6660997c12ed44e0&btmpl=authsub&hl=en https://accounts.google.com/AccountChooser?service=lso&conti... Per the screen, it only allows: " - View your full name, profile picture and profile URL" " - View any publicly available information on your Google+ profile (if you have one or create one in the future)" It can't see your photos, see your contacts, read your email, post G+ messages, or anything else you didn't authorise.
- hueving 12y agoI think you are misunderstanding what he is saying. If you use Google to prove your identity to every website you use, you are giving Google access to all of those websites.
- nailer 12y agoYeah you're right, see my other reply.
- Kliment 12y agoI believe the intended meaning was that if you login at randomsite with google, google has access to your randomsite account, as opposed to randomsite having access to your google account.
- nailer 12y agoThanks. Actually now I re-read what he wrote, although it wasn't obvious, he did convey that. So, in other words: - RandomWebApp lets users log in with Google. - A RandomWebApp user has a Google account, and allows RandomWebApp to oauth against his Google account. - Since Google issue the access token used for RandomWebApp, Google could conceivably access RandomWebApp on the user's behalf. That's a legitimate concern.
- aidenn0 12y agoIf you can reset your password with access to your gmail account, then Google can already do this, yes?
- slavik81 12y agoThat's not a very quiet way of doing it, though. Even if they hid the reset email from me, I'd be locked out of my account, which could raise suspicions.
- jrochkind1 12y ago