The OAuth RFC states:
OAuth uses tokens to represent the authorization granted to the
client by the resource owner. Typically, token credentials are
issued by the server at the resource owner's request, after
authenticating the resource owner's identity (usually using a
username and password).
There are many ways in which a server can facilitate the provisioning
of token credentials. This section defines one such way, using HTTP
redirections and the resource owner's user-agent. This redirection-
based authorization method includes three steps:
The client obtains a set of temporary credentials from the server
(in the form of an identifier and shared-secret). The temporary
credentials are used to identify the access request throughout
the authorization process.
The resource owner authorizes the server to grant the client's
access request (identified by the temporary credentials).
The client uses the temporary credentials to request a set of
token credentials from the server, which will enable it to access
the resource owner's protected resources.
So to have the authorisation, the client (the site using your data) must redirect you to the server that holds your data for signing up.
At Section 2.2 the RFC states :
The way in which the server handles the authorization request,
including whether it uses a secure channel such as TLS/SSL is beyond
the scope of this specification. However, the server MUST first
verify the identity of the resource owner.
But definitely I (as resource owner) won't use any OAuth-orisation without checking the certificate of the site.
So for OAuth 1.0 this is not mandatory.
The OAuth 2.0 RFC is still a draft but I understand that it requires TLS
10.9. Endpoints Authenticity
In order to prevent man-in-the-middle and phishing attacks, the
authorization server MUST implement and require TLS with server
authentication as defined by [RFC2818] for any request sent to the
authorization and token endpoints. The client MUST validate the
authorization server's TLS certificate in accordance with its
requirements for server identity authentication.
[...]
10.11[...]
To reduce the risk of phishing attacks, the authorization servers
MUST utilize TLS on every endpoint used for end-user interaction
Hence the authentication relies on TLS protocol as it was discussed on the blog recently.
To summarise I would suspect any attempt to OAuth without TLS as malicious. And of course the same if the SSL certificates does not validate.
