For machine to machine communication (embedding other applications in applications etc.) we often face the problem that the site we're embedding requires a username and a password to authenticate. The issue being that the username and password has to be sent in plain text, so because there is no human intervention they must be stored in plain text (at rest).
So, after discussing oauth (e.g. auth0) we just wanted to check our understanding.
Is it addition of the authorization server (and the benefits of tokens etc.) that makes oauth preferential to usernames and passwords? From a "security at rest" perspective oauth isn't any different to storing a username and password in plain text, versus storing a client id and secret in plain text?
Can you ever keep a client secret secure at rest if it has to be used programmatically (so can't be hashed, salted etc.)?