The OAuth2 specification says:

The interaction between the authorization server and resource server is beyond the scope of this specification. The authorization server may be the same server as the resource server or a separate entity.

I feel that this means that the authorization server is like a trusted big brother here, which can easily, but yet maliciously, gain access to data that should normally be restricted to legitimate users. If that is the case, why are Facebook, etc. considered as typical authorization servers? Why should they be so much trusted? I might have missed something basic here. So, I display my ignorance in the hope of becoming less ignorant.

  • OAuth and OpenId are similar but still quite a bit different in scope. With OpenId you can log into [website] using your Facebook account while the purpose of OAuth is to give [website] limited access to private data in your Facebook account. The difference is that in the first case, you trust Facebook to not screw with your account on [website] while in the second case you trust [website] to not screw with your account on Facebook.
    – Philipp
    Commented Dec 22, 2015 at 3:33
  • I was referring to oauth2 as used by openId-Connect
    – Dominic108
    Commented Jun 2, 2016 at 8:43

2 Answers 2


Why should [Facebook and other large companies] get the status of trusted parties?

Anybody can be a trusted party simply by trusting them to provide account authorization. For these large companies, they're common authorization servers because it's simple and generally the world is trusting them to maintain security over accounts. An employee or attacker that steps out of bounds with access to account controls at one of those companies can sign in as anybody.

Together, Facebook and Google have some of the largest collections of user accounts in the world with strong security teams. Most of your users will have an account with at least one of these companies. If you want to simplify the overhead of setting up an authentication system and also make it easy for users to use your service without having to go through a registration flow, that's most of it.

  • I edited my question. I understand that we can trust them to execute safely the authorization mechanism. What I don't understand is why we can trust that they would not access data that we don't want them to access. It is at this level that I am not sure if I am missing something,
    – Dominic108
    Commented Dec 21, 2015 at 23:00
  • @Dominic108 Reputation and legal ramifications. With larger companies like those, you also expect them to have strong policies and internal security controls to prevent most employees and external threads from achieving that level of access.
    – Jeff Ferland
    Commented Dec 21, 2015 at 23:42
  • Good! Most employees will be prevented from doing that.
    – Dominic108
    Commented Dec 22, 2015 at 0:59
  • I feel that it should be better documented that OpenID with Facebook, etc. requires that we trust these big companies for more than only authorization.
    – Dominic108
    Commented Dec 22, 2015 at 3:14

Large companies like Google and Facebook have a reputation to lose.

Considering their scale of operation, there is not much to gain by breaking into the account of some user on some other website. But should they do it and get caught, it would be quite a scandal which would severely hurt their reputation and make their users question their trustworthiness.

People already put quite a lot of trust into companies like Facebook and Google. Most users of their services are aware by now that these companies data-mine every click they make. And they are aware that these companies know more about them than they know about themselves. And these users are perfectly OK with it because they trust these companies to only use that knowledge for content recommendation and advertisement targeting, not for destroying their life. If they already put that much trust in them, also trusting them as an authorization provider for other service isn't a large step.

Personally I never use OpenID with an authentication provider which is not affiliated with the website I am logging into. Not only because I don't trust most of the websites frequently used as authentication providers, but also because the website I log into doesn't need to know if and which identities I have on other websites. But I am aware that my standard of privacy is higher than that of most people.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .