News for hackers. Stuff that matters.

A comment on Both Facebook and Cambridge Analytica Threatened to Sue Journalists. Parent comment

Re:Both Facebook and Cambridge Analytica Threatened to Sue J... by fdw on Tuesday March 20, 2018 @02:39PM (#16631303)
No, this is not how OAuth works - OAuth itself is just a protocol to receive authorization from another server [1]. In this case, a third party relies on Facebook to say "This user has logged into Facebook and their ID is foo". OAuth _does not need_ social information or anything else.

Of course, you can allow the authorization server to publish these details, but this is not an inherent part of OAuth. Also, there's OpenID Connect [2] which builds on OAuth and adds just this information in another token: "The ID token resembles the concept of an identity card, in a standard JWT format." (from [2]). However, you can happily use OAuth without ever publishing the user's details.

[1] https://tools.ietf.org/html/rfc6749 [2] https://openid.net/connect/

[ Parent | on HN ]
Re:Both Facebook and Cambridge Analytica Threatened to Sue J... by darawk on Tuesday March 20, 2018 @03:58PM (#16631978)
Yes, but my point is that the permission grant is explicit.
[ Parent | on HN ]
Re:Both Facebook and Cambridge Analytica Threatened to Sue J... by fdw on Wednesday March 21, 2018 @03:41AM (#16636232)
Yes, it is explicit.

I took your comment to say "You have to allow access to your data if you're using OAuth, because that's how OAuth works", and wanted to argue against that. The OAuth protocol is so complicated because it tries to be safe and secure and so it doesn't force any data disclosure. However, I now see that you probably meant "OAuth forces you to accept these permissions explicitely". In that case, we're hopefully both right :)

[ Parent | on HN ]
Re:Both Facebook and Cambridge Analytica Threatened to Sue J... by olleromam91 on Tuesday March 20, 2018 @10:40PM (#16634882)
We (the general public) grant permission for facebook to use our data, with the expectation that they don't let any bad actors do anything with it that harms us (the general public). This has been their image, this is what they espouse, and it is clearly not what happened.
[ Parent | on HN ]