Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential security advantages (or disadvantages) versus a traditional authentication model where a user would create a username and password specifically for my site, and my site manages the entire user store and authentication process?

Thanks in Advance

share|improve this question
2  
"Safer" is a fairly arbitrary word in security. Safer from what? Safer for whom? Who and what are you trying to protect? –  Steve Apr 2 '13 at 0:58
    
Safer for login –  ahmed amro Apr 2 '13 at 11:10
    
You assert that thereare secruity disadvantages. Could you back up that claim? I think it is prima facia that identity silos are less secure than managed identities. –  Mark C. Wallace Apr 2 '13 at 13:47

1 Answer 1

up vote 6 down vote accepted

This does depend on your situation, but the short answer is don't re-invent the wheel if you don't have to.

If you can take advantage of OAuth/OpenID (stackoverflow does) then you probably should. This can be more for connivence then security, sites will offer OpenID but allow you to create a login if you don't already have one (so as to cover all bases). You need to determine what is best given your audience.

The benefit of leveraging other peoples authentication (facebook or G+ in this example) is that you leave them to worry about properly authenticating their users.

You could try to build it yourself, although you'll need to make sure you do so in a secure fashion. The advantage of rolling your own may be that you're not as popular and therefore potentially not an interesting enough target (although this does depend on your situation and isn't a security tactic itself). If you make some rookie mistakes, then you're leaving yourself open to potential attacks.

There are of course disadvantages in leveraging other peoples authentication. For instance someone might have given away their facebook password to a friend, who can now login to our site if you allow login via FB. Of course the same thing could happen with any authentication system, but you don't have control of the FB/G+ authentication so this comes down to your own research of how suitable this would be.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.