2

Say we signup and login to an OAuth 2.0 enabled security application called "AI Car Command Center" via Google OAuth 2.0

We then logout.

Does Google then have the capability to then grant itself access to "AI Car Command Center", if it was forced to by some entity, of course without the account owner's consent or credentials?

Examples of popular OAuth 2.0 services include:

  • Google
  • Facebook
  • Github

Remember the OAuth 2.0 login flow:

  1. "AI Car Command Center" redirect to OAuth Google
  2. Google generates an valid OAuth grant token, but without user consent
  3. "AI Car Command Center" validates Google token
  4. Google then has full, unsolicited access to "AI Car Command Center"?

We can mitigate this by adding 2FA (TOTP) among other techniques. As a sub question, it may be useful to mention these briefly.

Also, it was mentioned that OpenID is a more appropriate protocol for identity verification rather than OAuth2.0

1
  • Most of SSO service doesn't pass User credentials to third party service. Therefore it is not possible to happen. – Infra Mar 5 at 13:41
1

The explanations in this answer are a bit imprecise and simplified to make them more understandable for someone that has only basic knowledge of OpenID and OAuth.

I assume that you are talking about OpenID instead of OAuth. OAuth is used when for example a google user delegates access to parts of his account to you - for example to allow you to see his contacts in GMail.

You use OpenID when you want to know about the identity of someone. In that case you tell OpenID provider that you want to know the identity of the current user. The OpenID provider then sends you a token that holds information about that user - after the user logged in at the OpenID provider.
You then read that token and identify the corresponding user in your database. If that is successful the user is logged in within your application.

In this process you obviously trust the information in that token. The OpenID Provider has created that token. So you trust the information provided by the OpenID Provider.

In the end the OpenID Provider could create malicious tokens faking someone else's identity. However - without the presence of a vulnerability in your application or the OpenID Provider - an active attacker within the OpenID Provider would be necessary.

4
  • Isn't OpenID and simple identity layer on top of the OAuth 2.0 protocol? – PathToLife Mar 6 at 1:52
  • OpenID is an authentication protocol that is based on OAuth 2. But OAuth2 is an authorization protocol. The use cases are quite different. – BenjaminH Mar 6 at 7:05
  • thanks for the clarification. I've been using OAuth2 for identity verification via passportjs, should look into OpenID – PathToLife Mar 6 at 7:12
1

It looks like a should I trust xxx question. And in fact, when an application service delegates its authentication to an OAuth 2.0 provider, it means that it does trust that provider.

Among what the OAuth 2.0 provider could do:

  • reject valid authentication request leading to something close to a Deny Of Service
  • log valid user names and then decide to later allow them whatever the password (when the request comes from some origine they know) allowing attackers to impersonate legitim users

Well known OAuth providers really do not want to go that way, because the application services are their customers and they need that customer relationship. But whether you can trust them is a true security problem and should be handled with the usual questions:

  • what is the threat
  • what is the risk (photos of my pets could be compromissed or a nuclear weapon could be launched)
  • what attackers do I want to be protected from (my 12 years cousin or the CIA/NSA)

For light to medium security needs, well known public OAuth 2.0 provider can probably be trusted, for organization strategic or national defense security ones, they should not.

3
  • Thanks for the clarification! Sorry can't upvote both – PathToLife Mar 6 at 7:16
  • Loved this: For light to medium security needs, well known public OAuth 2.0 provider can probably be trusted, for organization strategic or national defense security ones, they should not. – PathToLife Mar 6 at 7:16
  • If you do get more votes, i'll adjust accepted answer :) – PathToLife Mar 6 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.