Hacker News Reader

According to the lead author and editor of OAuth 2.0, (who asked that is name be removed from the spec) is: "a bad protocol."

Developer Quits OAuth 2.0 Spec, Calls It 'a Bad Protocol' - https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec...

"OAuth 2.0 and the Road to Hell" - https://news.ycombinator.com/item?id=4294959

View on HN

Strongly recommend reading this, as well as looking up Homakov's exploits. My opinion is that OAuth 2.0 is a very bad spec because in practice people do not implement it correctly. As to why? Maybe it's that the spec is split across multiple RFCs, and defines many insecure behaviors as compliant, and authorization is just hard.

When Facebook, Twitter, Github, etc. all got burned at various points in time with their OAuth implementations, you have to start looking for the common denominator.

> My opinion is that OAuth 2.0 is a very bad spec because in practice people do not implement it correctly.

Can we just stop using oauth entirely, then? There's got to be something better.

Oauth 2.1

> Keep in mind that when OAuth 2.0 was published in 2012, the iPhone 5 was brand new, the latest browser from Microsoft was Internet Explorer 9, single-page apps were called “AJAX apps”, and CORS was not yet an established W3C standard.

Reply on news.ycombinator.com