I did not personally authorize StackOverflow to access my personal GitHub account through GitHub API, so what could this possibly mean?
-
assuming it's a bad thing, i logged in and revoked the access, but was likely too late if it is bad. fortunately i have nothing currently of import on all my github accounts combinded, so just curious at this point– EricBalingitMar 3 at 12:55
-
Just to clarify, you did never use the "Sign up / Log in with GitHub" feature on StackOverflow but StackOverflow was listed as "Authorized OAuth Apps" on your GitHub account?– fleitnerMar 3 at 14:38
-
@flietner indeed, i tapped login with github, which seems to have led to the confusion.– EricBalingitMar 3 at 15:21
Add a comment
|
1 Answer
This is nothing malicious but a way to sign in to StackOverflow.
OAuth is a standard to use an existing account on one platform (identity provider) to authenticate to another platform (application) instead of the traditional username/password combination.
The advantages are that you do not have to remember another set of credentials and the application can not accidentally lose them if they have a breach.
Of course, any breach at the identity provider is much more severe as it may compromise multiple applications at once. Therefore only a few major providers exist that are widely used, for example, GitHub, Google, or FaceBook. They are trusted enough to keep their systems secure (OAuth itself is an open standard and anyone could implement an OAuth service).
Here, GitHub is the identity provider while StackOverflow is the application that consumes it. If you use the feature for the first time, GitHub asks for permission to share parts of your identity with the application, in this case, read-only access to the email address:
In your GitHub account, StackOverflow will be listed as an application that is authorized to consume your GitHub identity both as an overview of which applications are allowed to consume your identity and to revoke the permission if it is no longer required.
