3

Stack Exchange API 2.2 is finally out, (Yay!)

Reading through the linked blog post, i notice the line:

Login methods that don’t use OAuth can’t be made public for security reasons.

Is this something to worry about?
Seems kinda suspicious. Sounds like Security Through Obsurity.
"If know one knows how it works they can't hack it."
Or that their are known bugs in the (nonOAuth) logon methods that leave them insecure, and they are more exploitable through the API (but that means they exist, and can, with the right tools be exploited anyway.)

2
  • There is a way to circumvent just about everything designed to stop me from getting your password unless I don't know WHAT is stopping me from getting your password. I'm not saying that "security through obscurity" should be relied upon, but it certainly can help to make attacks more difficult, which, at the end of the day, is all we can really do to protect ourselves.
    – KnightOfNi
    Feb 11, 2014 at 21:49
  • Just my guess but "security concerns" could mean they just didn't want to spend the time/money to make it work. Not many people question it when you say "security reasons..."
    – Daisetsu
    Feb 11, 2014 at 21:58

1 Answer 1

1

It is probably more to make it more difficult to exploit via a fake login page. If it was possible for a login to be done through the API, then a fake login could be done on another site. OAuth provides some level of protection against this because of how the information is exchanged.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .