Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0
We then logout.
Does Google then have the capability to then grant itself access to "AI Car Command Center", if it was forced to by some entity, of course without the account owner's consent or credentials?
Examples of popular OAuth 2.0 services include:
For example this is a possible attack on the OAuth 2.0 login flow:
- BadOAuthCompany goes to "AI Car Command Center" and clicks login via OAuth button.
- "AI Car Command Center" redirects to BadOAuthCompany to login.
- BadOAuthCompany generates for its self an valid OAuth grant token for a user that has registered with them, but without the user's consent
- "AI Car Command Center" validates Google token
- BadOAuthCompany then has full, unsolicited access to "AI Car Command Center"?
We can mitigate this by adding 2FA (TOTP) among other techniques. As a sub question, it may be useful to mention these briefly.
Also, it was mentioned that OpenID is a more appropriate protocol for identity verification rather than OAuth2.0