Twitter fanatic glimpses dark side of OAuth
A mobile enthusiast and professional internet strategist got a glimpse of OAuth's dark side recently when he received an urgent advisory from Twitter. The dispatch, generated when Terence Eden tried to log in, said his Twitter account may have been compromised and advised he change his password. After making sure the alert was …
i know its new to alot of people but i was thinking this the other day what if they get your google oauth then the can do all kinda nasty but you just revoke the tokens and if you have already been hacked then you already prolly sent some spam for them so a couple more messages because you forgot to revoke tokens isnt that bad. could they make it more clear how to clear the tokens and such yes but its not that bad
Mines the with the token in ... oh, I seem to have lost my token. Do you by any chance have it?
"oh, I seem to have lost my token. Do you by any chance have it?"
It's in the ethernet
Credit to Scott Adams.
Several years ago at the company a company I worked for, a fairly senior manager (admittidely in jest) told me the he objected to his laptop asking him if he had a 'token ring' when it booted up.
(You couldn't use the particular TR cards disconnected without a 'one or more services or drivers have failed' error, so we had to use NT4's hardware profiles to get round this, hence the question.)
"Unless you revoke these tokens when you change your password, a malicious user will still have access to your twitter account,"
Well, yes. That's what it's for.
Good to see people reinventing the wheel. There was this thing called kerberos once (ok, there still is), and there too people had to manage the "ticket granting ticket". Don't think they ever got around to automating that in a meaningful way, except automatically destroying it when done. Oh, and understanding that it had to reside on a trusted machine (your workstation), not some third party website. Here, well, I think they looked at it and perhaps gotten it ever so slightly wrong. Or they didn't look at it at all and gotten it ever so slightly wrong. Much like openid, really. Privacy? Hah.
So, once again we have convenience weighted against security, and a person from one side finds it lacking. How is this different from (other) centralized authentication schemes?
If you are upset that changing your password means that you DON'T have to go around to each and every other site you visited and update the credentials there, why use a centralized scheme to begin with?
Sign up, sign up for The Register's weekly IT security newsletter - click here
