Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential security advantages (or disadvantages) versus a traditional authentication model where a user would create a username and password specifically for my site, and my site manages the entire user store and authentication process?
Thanks in Advance
This does depend on your situation, but the short answer is don't re-invent the wheel if you don't have to.
If you can take advantage of OAuth/OpenID (stackoverflow does) then you probably should. This can be more for connivence then security, sites will offer OpenID but allow you to create a login if you don't already have one (so as to cover all bases). You need to determine what is best given your audience.
The benefit of leveraging other peoples authentication (facebook or G+ in this example) is that you leave them to worry about properly authenticating their users.
You could try to build it yourself, although you'll need to make sure you do so in a secure fashion. The advantage of rolling your own may be that you're not as popular and therefore potentially not an interesting enough target (although this does depend on your situation and isn't a security tactic itself). If you make some rookie mistakes, then you're leaving yourself open to potential attacks.
There are of course disadvantages in leveraging other peoples authentication. For instance someone might have given away their facebook password to a friend, who can now login to our site if you allow login via FB. Of course the same thing could happen with any authentication system, but you don't have control of the FB/G+ authentication so this comes down to your own research of how suitable this would be.
