OAUTH seems like a pretty good idea when it comes to helping people authenticate, cuts down on the # of passwords to remember and in general eases the friction of on-boarding. However it would mean that once you compromise one account, you would be able to get into lots of things, all you would need to do is know other sites that used this connection to raise all kinds of havoc.

Do the positives outweigh the negatives when using OAUTH.

In my case I use google as OAUTH for several sites, but my google account is protected with 2 factor auth which many of the other sites don't provide. Does the google 2 factor combined with OAUTH make the other accounts more secure or less secure?

What are the questions I haven't thought of yet in this space?

closed as too broad by Xander, Gilles, schroeder, Mark, Eric G Apr 4 '15 at 19:53

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    This is an unanswerable question. It's going to depend on the threat model of the individual application in question. – Xander Apr 3 '15 at 19:19

Using OAUTH and 2 factor auth is the best way to go in my opinion. Your main account is protected and the other sites just serve up an authentication token to verify against. If the token becomes compromised the rest of your accounts are still safe, just the one token needs to get revoked.

Also if youre not using 2fa and your password gets compromised you dont have to go change your passwords on all accounts. A password change on your main account SHOULD revoke all other tokens currently issued. All your other accounts are now safe.

Not the answer you're looking for? Browse other questions tagged or ask your own question.