Is using OAuth for login less or more secure than maintaining your own passwords?

Question

Pros:

• The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly.
• The user doesn't have to maintain yet another vulnerable, duplicated passwords.

Cons:

• The OAuth client company now holds onto real bearer tokens. This seems like a step backwards from only having to hold onto irrecoverable password hashes. I'm not sure if these bearer tokens can do much though.

Is there a crucial reason one is clearly more secure than the other? Is there an accepted preference within the security community? It's possible I'm missing OAuth facts that tip this.

Answer 1

The idea behind OAuth is that as a service you do not need to know the credentials (yet again) in order to authenticate and personalize the service.

You are correct in that the bearer tokens (part of OAuth 2 in fact) are just as sensitive as username/password. but so is a hash of it.

The idea is that with OAuth 2 you authenticate with the OAuth 2 Server-provider, the server than hands you (or in fact the application your authenticating with) a set of tokens to use.

• Bearer token, short lived token to directly use for authenticated requests.
• Refresh token, Long lived token to get a new Bearer token.

The OAuth application uses these together with its own preregistered secrets (Application ID and Application Key) and a TLS connection (https) to keep things secure and secret.

The end result is a scheme that is at least as secure as the login scheme of the OAuth service provider,
without having to maintain a new set of credentials and without having to disclose the credentials to the possible 3rd party that is the OAuth client service.
As a bonus there is no requirement for the client to use TLS and still have a secure login
(although I highly recommend TLS for any web-application myself).

And when 'grants' are used it is possible to limit what information the tokens can be used for,
like facebook, google and github show users that authenticate with oauth.

The following image taken from Wikipedia illustrates how oauth works differently than username/password schemes and why it can be advantageous.