4 ms·

I believe the intended meaning was that if you login at randomsite with google, google has access to your randomsite account, as opposed to randomsite having ac

by Kliment 12y ago

I believe the intended meaning was that if you login at randomsite with google, google has access to your randomsite account, as opposed to randomsite having access to your google account.

nailer 12y ago
Thanks. Actually now I re-read what he wrote, although it wasn't obvious, he did convey that. So, in other words: - RandomWebApp lets users log in with Google. - A RandomWebApp user has a Google account, and allows RandomWebApp to oauth against his Google account. - Since Google issue the access token used for RandomWebApp, Google could conceivably access RandomWebApp on the user's behalf. That's a legitimate concern.
- aidenn0 12y ago
  If you can reset your password with access to your gmail account, then Google can already do this, yes?
  - slavik81 12y ago
    That's not a very quiet way of doing it, though. Even if they hid the reset email from me, I'd be locked out of my account, which could raise suspicions.
- jrochkind1 12y ago
  It's a legitimate concern, but there's no way around it with third-party authentication. You always need to trust your identity provider, don't you? I don't see how separating identification and authorization conceptually helps. You have to trust your identification provider, in any kind of a federated or multi-party system. (Ie, a system where you can log into your google account and get access to another system, whether using OpenID 1.0, 2.0, OAuth, whatever).
  - espadrine 12y ago
    Having Google impersonate me is not what I fear, it is so obviously evil. Having Google hurt me is what I fear. Google's use of its identity service is not on an equal footing as RandomWebApp's. Having a Google+ identity means accepting its TOS for a specific list of services provided by Google[1]. Violating the TOS (eg, by misusing, even accidentally, one of Google's services (think DMCA and ContentID mis-tagging fair use material, or even by not providing the name that the US has registered for you)) means losing your identity. That has definitely happened to at least a dozen of people I know. Additionally, Google enforces identity in the context of a company based in the US. Whatever obligations it has in front of its government, and whatever weaknesses the government finds, will allow misusing your identity, even when Google itself isn't being evil. [1] Excerpt from the TOS: > Our Services are very diverse, so sometimes additional terms or product requirements (including age requirements) may apply. Additional terms will be available with the relevant Services, and those additional terms become part of your agreement with us if you use those Services. https://www.google.fr/intl/en/policies/terms/regional.html https://www.google.fr/intl/en/policies/terms/regional.html

by Kliment 12y ago

I believe the intended meaning was that if you login at randomsite with google, google has access to your randomsite account, as opposed to randomsite having access to your google account.

nailer 12y ago

Thanks. Actually now I re-read what he wrote, although it wasn't obvious, he did convey that. So, in other words: - RandomWebApp lets users log in with Google. - A RandomWebApp user has a Google account, and allows RandomWebApp to oauth against his Google account. - Since Google issue the access token used for RandomWebApp, Google could conceivably access RandomWebApp on the user's behalf. That's a legitimate concern.

aidenn0 12y ago
If you can reset your password with access to your gmail account, then Google can already do this, yes?
- slavik81 12y ago
  That's not a very quiet way of doing it, though. Even if they hid the reset email from me, I'd be locked out of my account, which could raise suspicions.
jrochkind1 12y ago
It's a legitimate concern, but there's no way around it with third-party authentication. You always need to trust your identity provider, don't you? I don't see how separating identification and authorization conceptually helps. You have to trust your identification provider, in any kind of a federated or multi-party system. (Ie, a system where you can log into your google account and get access to another system, whether using OpenID 1.0, 2.0, OAuth, whatever).
- espadrine 12y ago
  Having Google impersonate me is not what I fear, it is so obviously evil. Having Google hurt me is what I fear. Google's use of its identity service is not on an equal footing as RandomWebApp's. Having a Google+ identity means accepting its TOS for a specific list of services provided by Google[1]. Violating the TOS (eg, by misusing, even accidentally, one of Google's services (think DMCA and ContentID mis-tagging fair use material, or even by not providing the name that the US has registered for you)) means losing your identity. That has definitely happened to at least a dozen of people I know. Additionally, Google enforces identity in the context of a company based in the US. Whatever obligations it has in front of its government, and whatever weaknesses the government finds, will allow misusing your identity, even when Google itself isn't being evil. [1] Excerpt from the TOS: > Our Services are very diverse, so sometimes additional terms or product requirements (including age requirements) may apply. Additional terms will be available with the relevant Services, and those additional terms become part of your agreement with us if you use those Services. https://www.google.fr/intl/en/policies/terms/regional.html https://www.google.fr/intl/en/policies/terms/regional.html