As an exercise, I'm developing a desktop application with which users need to log in to a web service. A logical use-case for OAuth2 one would say, but I'm beginning to doubt its usefulness. I am looking for two-legged authentication, which leaves the client credentials, implicit and resource owner password flows available.
Because I would like users to be able to directly log in inside the application (not through a browser and redirect URI), the implicit flow falls away as an option. The other two flows require for the client_id
and client_secret
to be sent along, and I've read plenty of times it is unsafe to store the client_secret
inside your desktop application.
My question is this: how unsafe is this really? How easy is it for adversaries to decompile (desktop) applications and figure out the client_secret
? I could consider accepting the risk, so that I can use OAuth2's client credentials flow, because rolling my own authentication scheme would probably be even less secure.
P.S. Someone mentioned using implicit flow and temporarily starting a webserver at localhost as the redirect URI to circumvent a browser, but that seems excessive if not insecure. Any thoughts?