Hacker News Reader

That post is very popular, but there is a follow up posting on OpenID Connect and that it can makes sense. I have to dig that out though, couldn't find the link in my bookmarks.

also noteworthy that the blog post is 4 years old and OAuth2 is basically everywhere :)

Also noteworthy that adoption doesn't change any of the points made.

adoption doesn't change the points semantically, but it shows that a large part of the (corporate) secrutiy community weighs those arguments (much) less than the author does.

ok, I finally found it. Note that it's still from 2012 and we've moved along from that dispute.

* http://www.thread-safe.com/2012/07/the-oauth-2-sky-is-not-fa... * https://hueniverse.com/2012/07/30/on-leaving-oauth/

Good graces? It's not perfect, mostly people over-granting permissions.. but in most cases you can't run into an API or other rights sharing tool without OAuth2.