On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential security advantages (or disadvantages) versus a traditional authentication model where a user would create a username and password specifically for my site, and my site manages the entire user store and authentication process?

Thanks in Advance

  • 2
    "Safer" is a fairly arbitrary word in security. Safer from what? Safer for whom? Who and what are you trying to protect?
    – Steve
    Apr 2, 2013 at 0:58
  • Safer for login
    – ahmed amro
    Apr 2, 2013 at 11:10
  • You assert that thereare secruity disadvantages. Could you back up that claim? I think it is prima facia that identity silos are less secure than managed identities.
    – MCW
    Apr 2, 2013 at 13:47

1 Answer 1


This does depend on your situation, but the short answer is don't re-invent the wheel if you don't have to.

If you can take advantage of OAuth/OpenID (stackoverflow does) then you probably should. This can be more for connivence then security, sites will offer OpenID but allow you to create a login if you don't already have one (so as to cover all bases). You need to determine what is best given your audience.

The benefit of leveraging other peoples authentication (facebook or G+ in this example) is that you leave them to worry about properly authenticating their users.

You could try to build it yourself, although you'll need to make sure you do so in a secure fashion. The advantage of rolling your own may be that you're not as popular and therefore potentially not an interesting enough target (although this does depend on your situation and isn't a security tactic itself). If you make some rookie mistakes, then you're leaving yourself open to potential attacks.

There are of course disadvantages in leveraging other peoples authentication. For instance someone might have given away their facebook password to a friend, who can now login to our site if you allow login via FB. Of course the same thing could happen with any authentication system, but you don't have control of the FB/G+ authentication so this comes down to your own research of how suitable this would be.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .