Tagged Questions
5
votes
1answer
56 views
What are the security challenges encountered with attribute exchange?
OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers.
What are the ...
4
votes
1answer
431 views
Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?
I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
13
votes
2answers
752 views
Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
It's clear there there is no consistent set of features among any of the popular authentication providers.
Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
30
votes
5answers
5k views
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage ...
26
votes
9answers
2k views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
