Re:This MIT Website Tracks Your Digital Footprint Through Gmail
by eterm on Friday July 05, 2013 @11:14AM
(#5995210)
It's not just any OAuth token it's a token that asks for permissions to "view all your mail" among other things.
Most Oauth tokens won't ask for this highly elevated permission.
OAuth is not designed around Authentication, the Auth in OAuth is actually about Authorisation. It was designed for this purpose, to authorise others to have access to your mail, or contacts, etc. That it has been co-opted for Authentication purposes (particularly in Oauth2) has just been a side effect.
Most Oauth tokens won't ask for this highly elevated permission.
OAuth is not designed around Authentication, the Auth in OAuth is actually about Authorisation. It was designed for this purpose, to authorise others to have access to your mail, or contacts, etc. That it has been co-opted for Authentication purposes (particularly in Oauth2) has just been a side effect.