3

Stack Exchange API 2.2 is finally out, (Yay!)

Reading through the linked blog post, i notice the line:

Login methods that don’t use OAuth can’t be made public for security reasons.

Is this something to worry about?
Seems kinda suspicious. Sounds like Security Through Obsurity.
"If know one knows how it works they can't hack it."
Or that their are known bugs in the (nonOAuth) logon methods that leave them insecure, and they are more exploitable through the API (but that means they exist, and can, with the right tools be exploited anyway.)

  • There is a way to circumvent just about everything designed to stop me from getting your password unless I don't know WHAT is stopping me from getting your password. I'm not saying that "security through obscurity" should be relied upon, but it certainly can help to make attacks more difficult, which, at the end of the day, is all we can really do to protect ourselves. – KnightOfNi Feb 11 '14 at 21:49
  • Just my guess but "security concerns" could mean they just didn't want to spend the time/money to make it work. Not many people question it when you say "security reasons..." – Daisetsu Feb 11 '14 at 21:58
1

It is probably more to make it more difficult to exploit via a fake login page. If it was possible for a login to be done through the API, then a fake login could be done on another site. OAuth provides some level of protection against this because of how the information is exchanged.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.