Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices.
Question
What makes OAuth 2.0 more appealing than OpenID specifically for mobile devices?
Is there a reason to use OAuth 2.0 that isn't exclusive to usage on mobile devices? (smaller payload, better home realm discovery)?
OAuth and OpenID have different purposes. OpenID revolves around the concept of proving "who you are" and hence is useful in the scenarios where you use one login to log in to multiple sites. However, OpenID doesn't talk about authorization for taking certain actions or accessing certain data of Site1 while you're on Site2. For example, you're on FaceBook and want to import your contacts from GMail, OpenID won't help you, but OAuth will (you will use OAuth to authorize FaceBook application to fetch contacts from your GMail account). Furthermore, the level of access authorization is also controlled via OAuth (for example, some applications/websites can request for access to your Twitter Direct Messages, while others only request access to Post tweets on your behalf).
Since majority of Mobile device access situations are about accessing data or posting data to a service, you would find OAuth being mentioned appropriately in the context. If you find a situation where the application only requires a login (proving your identity), but does not require access to your account's data, then OpenID is equally applicable.
For further reading, I would recommend this blog post: OAuth-OpenID: You’re Barking Up the Wrong Tree if you Think They’re the Same Thing
