I assume here that the web server is owned the client as is the desktop. If they aren't, then I have my answer and I misunderstood the differences between desktop Vs web server clients. If they are both owned by the client, I cannot see any serious explanation for why the application would be more secure on a web server. If anything, it would be less secure, because further away thus less in control. If the explanation is that a desktop often runs games and other kinds of unsafe applications, then this is what I call a non serious explanation, because the client would just have to set up a secure desktop. If the explanation is that the client itself is not trusted by the authorization server, then I have a problem, because, of course, the client should not be trusted, but how could it be better on a web server controlled by the client? I suspect that I will realize that I missed a basic point and I will be very happy or else the whole thing makes no sense.

  • 1
    Which part of the spec do you refer to exactly when you say native apps are considered to be less secure? can you providea link? – Out of Band Feb 12 '17 at 13:25
  • I didn't say that the spec said so. There was a if. If we use the spec with this idea to start with, then I disagree. If we interpret the spec, as if it said so, then I disagree. The reality of life, people being sloppy, etc. should be our concern, but should not result in the principle that desktops are less secure than servers, as if we have to go along with this, on the contrary. – Dominic108 Feb 12 '17 at 18:59
  • Oh ! Perhaps you meant in the question itself. Well, I explained in my own answer that I had a basic misunderstanding at the time. – Dominic108 Feb 12 '17 at 21:37

If the explanation is that a desktop often runs games and other kinds of unsafe applications, then this is what I call a non serious explanation, because the client would just have to set up a secure desktop.

This may be true in theory, but security is a practical endeavour. Servers are generally better secured than desktops. In practice, expecting users to install a "secure desktop" in order to run a specific application is doomed to fail.

For the same reason, assuming that something is less secure because it's further away and you have less control is faulty. Do you apply this reasoning when deciding where to keep your highly valuable items? I bet you don't. I bet you trust bank vaults more than your cupboard at home, even when it means a loss of direct control.

| improve this answer | |
  • Usually it's good if we divide a task in smaller parts so that we can trust the best person for each part. We must execute a task in a clever way so that it is robust against failure of some parts. Some of these parts could be best done locally. Technologies should provide this flexibility and support a flow of information so that informed decisions are taken. Current technologies do not do that, because banks, etc. depend on the opposite of that. So, we got the 2008 crisis, etc. – Dominic108 Feb 12 '17 at 9:22
  • Well, the 2008 crisis isn't really relevant for the physical security of bank vaults. I wasn't talking about partitioning, information flow, flexibility etc (all things that oauth does), I simply wanted to point out that it is relevant that servers are generally better secured than desktops, despite your dismissal of that argument as "non serious". – Out of Band Feb 12 '17 at 13:14
  • I just don't understand why it has to become a basic principle that servers are better secured than desktops. For me, it is like when one says that wars are a fact of life or seeking for profit (not defined in terms of the well being of people, but in terns of an artificial construction that we call money) is a fundamental rule of economy, etc. I know, one would say these are not the concerns of technology designers. This is my point. We should only provide the flexibility. People being sloppy is not a reason to make desktops less secure, just as violent people is not a reason to support war. – Dominic108 Feb 13 '17 at 8:45

OK, It was indeed a basic point. The client is not the owner of the resource. So, this is why it should not be on the desktop of the owner. We just have to keep in mind that there are four roles: the owner, the client, the authorization server and the resource server. So, a public client is a client that trust all the owners with the password.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.