Return to Question

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a homebrew method. Every site seems to be using these as well now for ease of use to the user, but also for security. I hear it every day almost that it's more secure, but I find that extremely hard to believe for a few reasons:

1. If a hacker somehow gets your password to one site, he know has access to the majority of the sites you visit now.

2. It makes phishing 10x easier. With so many people using the same logins and doing it over, and over again people are less likely to actually read everything and check the URL up top.

Could you list of more reasons why it's unsafe or could you explain to me why it is more safe? I don't see why you would put up with the hassle of integrating one of these when it seems like a user would be fine entering in 3 fields (username, password, email) instead of clicking service logo to login (Twitter, Google, FB etc), entering in their username/password, clicking submit, clicking approve.

==Update==

To expand on my question as per request.

To my two points above, #1, doesnt matter how the hacker gets it. Im not sure how to expand upon it exactly. You could brute force it, guess it, use the forgot password and do a dictionary attack on common questions, etc. But however you do it my point is, 1 password to access 1000 servers is far less safe than 1000 passwords to access 1000 different sites. I can personally guess a few of my friends' and family's passwords and ill have access to all kinds of accounts. I wouldnt even have to look for them. As i browse the web ill just be logged in... If i was a hacker, many of these passwords are very easy to crack. Some of my friend's passwords are, pepsi, tina(then birth year), 123456, and other stupid ones. My favorite though is tomcruisesucks LOL.

For #2 point, to expand further, I might go to http://wired.com, http://klout.com, http://twitter.com, http://thenextweb.com and they all have a Twitter login. I trust the sites (for the most part) so, honestly, I dont check the URL of the popup window that comes up to login anymore and I assume most do not. That popup window could have been easily hacked by a hacker getting on one of their servers, or an evil employee, or just a fake app site that a bot is sending to people over twitter that multiple people then login to this fake app, but using the Twitter login.

People are so used to seeing the same login pages they don't look anymore. If this thread gets popular enough I can easily do a super simple test on Twitter or FB by sending everyone a link to a fake app, have a popup window that looks like Twitter or FB and they'll login. I gurantee it. If i make the login screen go to, lets say, http://bankofamerica.com or http://paypal.com they'll ask themselves why am i here, why do they need this info, etc. The same sites used to login over and over again is extremely bad in practice.

Thats my expanded discussion point ;)

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use to the user, but also for security. I hear it every day almost that it's more secure, but I find that extremely hard to believe for a few reasons:

1. If a hacker somehow gets your password to one site, he know has access to the majority of the sites you visit now.

2. It makes phishing 10x easier. With so many people using the same logins and doing it over, and over again people are less likely to actually read everything and check the URL up top.

Could you list of more reasons why it's unsafe or could you explain to me why it is more safe? I don't see why you would put up with the hassle of integrating one of these when it seems like a user would be fine entering in 3 fields (username, password, email) instead of clicking service logo to login (Twitter, Google, FB etc), entering in their username/password, clicking submit, clicking approve.

==Update==

To expand on my question as per request.

To my two points above, #1, doesn't matter how the hacker gets it. I'm not sure how to expand upon it exactly. You could brute force it, guess it, use the forgot password and do a dictionary attack on common questions, etc. But however you do it my point is, 1 password to access 1000 servers is far less safe than 1000 passwords to access 1000 different sites. I can personally guess a few of my friends' and family's passwords and ill have access to all kinds of accounts. I wouldn't even have to look for them. As i browse the web ill just be logged in... If i was a hacker, many of these passwords are very easy to crack. Some of my friend's passwords are, pepsi, tina(then birth year), 123456, and other stupid ones. My favorite though is tomcruisesucks LOL.

For #2 point, to expand further, I might go to http://wired.com, http://klout.com, http://twitter.com, http://thenextweb.com and they all have a Twitter login. I trust the sites (for the most part) so, honestly, I don't check the URL of the popup window that comes up to login anymore and I assume most do not. That popup window could have been easily hacked by a hacker getting on one of their servers, or an evil employee, or just a fake app site that a bot is sending to people over twitter that multiple people then login to this fake app, but using the Twitter login.

People are so used to seeing the same login pages they don't look anymore. If this thread gets popular enough I can easily do a super simple test on Twitter or FB by sending everyone a link to a fake app, have a popup window that looks like Twitter or FB and they'll login. I guarantee it. If i make the login screen go to, lets say, http://bankofamerica.com or http://paypal.com they'll ask themselves why am i here, why do they need this info, etc. The same sites used to login over and over again is extremely bad in practice.

That's my expanded discussion point ;)

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a homebrew method. Every site seems to be using these as well now for ease of use to the user, but also for security. I hear it every day almost that it's more secure, but I find that extremely hard to believe for a few reasons:

1. If a hacker somehow gets your password to one site, he know has access to the majority of the sites you visit now.

2. It makes phishing 10x easier. With so many people using the same logins and doing it over, and over again people are less likely to actually read everything and check the URL up top.

Could you list of more reasons why it's unsafe or could you explain to me why it is more safe? I don't see why you would put up with the hassle of integrating one of these when it seems like a user would be fine entering in 3 fields (username, password, email) instead of clicking service logo to login (Twitter, Google, FB etc), entering in their username/password, clicking submit, clicking approve.

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a homebrew method. Every site seems to be using these as well now for ease of use to the user, but also for security. I hear it every day almost that it's more secure, but I find that extremely hard to believe for a few reasons:

1. If a hacker somehow gets your password to one site, he know has access to the majority of the sites you visit now.

2. It makes phishing 10x easier. With so many people using the same logins and doing it over, and over again people are less likely to actually read everything and check the URL up top.

Could you list of more reasons why it's unsafe or could you explain to me why it is more safe? I don't see why you would put up with the hassle of integrating one of these when it seems like a user would be fine entering in 3 fields (username, password, email) instead of clicking service logo to login (Twitter, Google, FB etc), entering in their username/password, clicking submit, clicking approve.

==Update==

To expand on my question as per request.

To my two points above, #1, doesnt matter how the hacker gets it. Im not sure how to expand upon it exactly. You could brute force it, guess it, use the forgot password and do a dictionary attack on common questions, etc. But however you do it my point is, 1 password to access 1000 servers is far less safe than 1000 passwords to access 1000 different sites. I can personally guess a few of my friends' and family's passwords and ill have access to all kinds of accounts. I wouldnt even have to look for them. As i browse the web ill just be logged in... If i was a hacker, many of these passwords are very easy to crack. Some of my friend's passwords are, pepsi, tina(then birth year), 123456, and other stupid ones. My favorite though is tomcruisesucks LOL.

For #2 point, to expand further, I might go to http://wired.com, http://klout.com, http://twitter.com, http://thenextweb.com and they all have a Twitter login. I trust the sites (for the most part) so, honestly, I dont check the URL of the popup window that comes up to login anymore and I assume most do not. That popup window could have been easily hacked by a hacker getting on one of their servers, or an evil employee, or just a fake app site that a bot is sending to people over twitter that multiple people then login to this fake app, but using the Twitter login.

People are so used to seeing the same login pages they don't look anymore. If this thread gets popular enough I can easily do a super simple test on Twitter or FB by sending everyone a link to a fake app, have a popup window that looks like Twitter or FB and they'll login. I gurantee it. If i make the login screen go to, lets say, http://bankofamerica.com or http://paypal.com they'll ask themselves why am i here, why do they need this info, etc. The same sites used to login over and over again is extremely bad in practice.

Thats my expanded discussion point ;)