Security differences between fb connect and openid connect

Question

I've been reading a lot about why plain oauth is bad for authentication, and one needs to at least build on top of it to reach an acceptable level of security.

That got me looking at the major oauth layered providers- Facebook Connect and Openid Connect.

Many websites say Facebook Connect has certain inherent issues that Openid Connect accounts for, but from a high level they seem to be adding the same things on top of oauth...

Can someone explain the differences in the protocols and what issues Facebook Connect has that the openid connect protocol covers?

Answer 1

In short: Privacy.

Facebook Connect's service provider is Facebook. Since Facebook is the provider of such service you depend not only on Facebook's reliability but also on Facebook Connect's not being blocked as well in the same countries where Facebook is blocked (censored to be precise).

Moreover, Facebook learns plenty of information about your behavior that you may not want to reveal to Facebook itself (they may offer the service for free but certainly they will analyse your authentication patterns...). You also depend on Facebook not censoring that particular service you want to use it to log in with.

Facebook Connect is simply an authentication layer like OpenID Connect where Facebook is the sole provider, but it is not open unfortunately. Technically they are likely to offer similar features but unless Facebook reveal any more details, we don't know. If you use Facebook Connect you are relying on Facebook and trusting Facebook. If you use OpenID Connect you rely on an open protocol, with all the public scrutiny that it implies.