News for hackers. Stuff that matters.

A comment on The Good and the Bad of OAuth 2.0 Authorization Implementations. Parent comment

Re:The Good and the Bad of OAuth 2.0 Authorization Implement... by peter_l_downs on Sunday January 27, 2013 @08:15PM (#5126534)
If you decide not to support the HMAC stuff, writing a server implementation for OAuth 2.0 isn't really that bad. Something I've been confused about since day one is the need for refresh token. If an attacker is able to sniff the auth token, wouldn't they be able to sniff the refresh token, too?
[ Parent | on HN ]
Re:The Good and the Bad of OAuth 2.0 Authorization Implement... by johns on Sunday January 27, 2013 @08:31PM (#5126577)
My understanding, and it may be wrong, is that if an attack walks off with your data, then wouldn't be able to refresh the access token you have on hand without the client ID and secret and so the extent to which they could compromise the authorized accounts is limited in time.
[ Parent | on HN ]
Re:The Good and the Bad of OAuth 2.0 Authorization Implement... by mikeknoop on Sunday January 27, 2013 @09:10PM (#5126707)
What's worse is when OAuth providers force the refresh tokens to be refreshed! Many OAuth providers are now requiring user-action (ie. re-walk through the oauth popup) every x months to get new refresh tokens.
[ Parent | on HN ]
Re:The Good and the Bad of OAuth 2.0 Authorization Implement... by X-Istence on Sunday January 27, 2013 @09:55PM (#5126845)
As a user I am actually okay with this. That way if I haven't visited a website in a long time, then most likely they should no longer have access to my account.

Maybe I've long moved on and forgotten about that one site that I authorised and now they are using my data in a way that I wouldn't approve of.

[ Parent | on HN ]
Re:The Good and the Bad of OAuth 2.0 Authorization Implement... by johns on Sunday January 27, 2013 @09:59PM (#5126854)
The tricky part is for services like IFTTT (where I used to work) and Zapier (where the GP works) where you do want an authorization to be indefinite and not require user interaction because it's a background job.
[ Parent | on HN ]
Re:The Good and the Bad of OAuth 2.0 Authorization Implement... by alanctgardner2 on Sunday January 27, 2013 @08:21PM (#5126553)
I've been wondering this as well. Maybe it protects against replay attacks? They're certainly a bit frustrating.
[ Parent | on HN ]