OAUTH seems like a pretty good idea when it comes to helping people authenticate, cuts down on the # of passwords to remember and in general eases the friction of on-boarding. However it would mean that once you compromise one account, you would be able to get into lots of things, all you would need to do is know other sites that used this connection to raise all kinds of havoc.

Do the positives outweigh the negatives when using OAUTH.

In my case I use google as OAUTH for several sites, but my google account is protected with 2 factor auth which many of the other sites don't provide. Does the google 2 factor combined with OAUTH make the other accounts more secure or less secure?

What are the questions I haven't thought of yet in this space?

  • 1
    This is an unanswerable question. It's going to depend on the threat model of the individual application in question. – Xander Apr 3 '15 at 19:19

Using OAUTH and 2 factor auth is the best way to go in my opinion. Your main account is protected and the other sites just serve up an authentication token to verify against. If the token becomes compromised the rest of your accounts are still safe, just the one token needs to get revoked.

Also if youre not using 2fa and your password gets compromised you dont have to go change your passwords on all accounts. A password change on your main account SHOULD revoke all other tokens currently issued. All your other accounts are now safe.

Not the answer you're looking for? Browse other questions tagged or ask your own question.