Hacker News new | past | comments | ask | show | jobs | submit login

1. Why use OAuth unless you want to grant 3rd parties access to your services data, on behalf of your customers?

2. Security best practices subject to "open for interpretation."




While OAuth isn't "for" authentication, everyone uses it that way by "authorizing" access to "view your email address" which is as good as authenticating your email address.


Can you link to implementations that use OAuth in such a manner?

Login with FB, Google, Github, Twitter, etc different systems, separate from OAuth.


GitHub How To: https://developer.github.com/guides/basics-of-authentication... And the OpenID Connect standard (essentially OAuth V2 + identity service): http://openid.net/connect/


> Why use OAuth unless you want to grant 3rd parties access to your services data, on behalf of your customers?

So, what would you use instead?


> Why use OAuth unless you want to grant 3rd parties access to your services data, on behalf of your customers?

Can you explain me this? How Google will be able to access my service data?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: