[dennish00a]

I just need to add my voice to the chorus: OAuth really, really sucks.

I don't understand what problem it solves. A malicious app (native or web) can find a way to get your password, period. A well-behaved app can have your password and do no harm. And, practically speaking, I don't know any real person who's had a problem that has been solved by the existence of OAuth.

OAuth is just a massive pain in the rear end.

[joe_the_user]

The "ideal" is to give the app permissions akin to another account. This way the app only changes what the user says it can change, etc, even to the point that users can upgrade or downgrade these permissions later.

The most obvious advantage is the app doesn't have to learn the users new password when they change passwords.

But you're right, the whole dance of having the app never `touch` the user's password is bullshit, a pretense cooked up by bureaucracy. You could get all the meaningful functionality of Oauth by letting apps request a single "permission key" when they login - with the user's password. On the other hand, if a site want real, meaningful security, it could give each user a seperate "app password" that they authorized apps with. That would provide real protection - but since it requires one teentsy extra step for the end user, it will never, ever fly.

[bct]

> You could get all the meaningful functionality of Oauth by letting apps request a single "permission key" when they login - with the user's password.

http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-1....

[bct]

> A well-behaved app can have your password and do no harm.

Until someone steals its database.

You hash your user's passwords, right? Same thing - whether you're talking about your app's passwords, or some 3rd party app's passwords, keeping them around in plain text is a bad idea.

[chrisrhoden]

And hashing them is not useful if you intend to authenticate with them. I think you mean encrypt. Hacker finds encryption key. See "Until someone steals its database."

[bct]

No, that's not what I meant. It's an analogy - if sites shouldn't store their own passwords in plaintext or reversibly encrypted (which everyone here agrees on - "use BCrypt", etc), then they shouldn't store other passwords in plaintext or reversibly encrypted. They should use something like OAuth instead.

[chrisrhoden]

My bad, we agree on this. But there are a whole bunch of other great things that OAuth brings.

[bct]

I must not have been very clear, because I'm being pro-OAuth here :)