I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to provide this they require you enter your username and password for the website you wish to integrate them with, they say they will encrypt your password using AES-256 and hash it using PBKDF2 hashing, however in my eyes this is still wrong as i've always been a believer that you don't enter your password for one website into another website, this is why things like OAuth exist in the first place.

Is what they're requesting perfectly legitimate and i'm being too sensitive to security or am I correct in saying this is weird?

Example; Website X asks for my Google username and password to integrate their service with my google account

  • "am I correct in saying this is weird?" - Yes, what you describe is really weird. – Steffen Ullrich Apr 22 at 17:27
  • Sounds like Phishing... – aholbreich Apr 22 at 17:59
  • There's a Brazilian company that offers social media management that's been widely successful here. Few day ago, Facebook took down 39 million posts made through that platform; FB is restoring these posts from thousands of clients but the company was banned from using their services. When my partner told me "we have to put our FB password there for it to work", I was like "Sorry, WHAT???". I'm not seeing the news on international channels, Portuguese only: www1.folha.uol.com.br/mercado/2021/06/… c/c @Steffen – brasofilo Jun 15 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.