Need someone to lead product management at your software company? I create software for people that create software and I'm looking for my next opportunity. Check out my resume and get in touch.

OAuth

Freshness Warning
This blog post is over 16 years old. It's possible that the information you read below isn't current and the links no longer work.

8 Oct 2007

OAuth is a great idea. As Six Apart says in their announcement of support...

Right now, if you want Flickr to post to your TypePad blog, or you want to connect a client to update both your Twitter account and your LiveJournal, you have to give them the password to your account, giving a third-party free reign on your site. Even worse, on some other services, the password for an account used for blogging or other applications is the same login that controls extremely sensitive information like your email account or credit card systems.

OAuth aims to standardize the way in which different consumer systems share data. The goal is to allow a person to give an application access to do some things on your accounts at other sites, but not everything. It’s role-based authorization for APIs.

Right now you give Facebook your Yahoo username and password so they can check so you can connect with Yahoo Mail contacts that are also on Facebook. That’s fine and dandy as long as Facebook doesn’t decide to do anything malicious with your account (like send an email to everyone, pretending to be you). Or as long as their systems aren’t compromised.

What OAuth wants to do is allow you to give Facebook permission to see your Hotmail contacts, but not to send them email, to change your contacts, or to read your mail.

At IMified, we’re looking into the specification and we’ll be implementing support in our apps. When you give us access to post to your Google Calendar, you shouldn’t have to trust us that we won’t also be reading your email. I mean, you can trust us, but you shouldn’t have to.

Mark Atwood
October 8, 2007 12:34 PM

I'm one of the specifiation authors for OAuth Core 1.0, and am very gratified to see all the positive buzz and takeup that it's generating.

This discussion has been closed.

Recently Written

Too Big To Fail (Apr 9): When a company piles resources on a new product idea, it doesn't have room to fail. That keeps it from succeeding.
Go small (Apr 4): The strengths of a large organization are the opposite of what makes innovation work. Starting something new requires that you start with a small team.
Start with a Belief (Apr 1): You can't use data to build products unless you start with a hypothesis.
Mastery doesn’t come from perfect planning (Dec 21): In a ceramics class, one group focused on a single perfect dish, while another made many with no quality focus. The result? A lesson in the value of practice over perfection.
The Dark Side of Input Metrics (Nov 27): Using input metrics in the wrong way can cause unexpected behaviors, stifled creativity, and micromanagement.
Reframe How You Think About Users of your Internal Platform (Nov 13): Changing from "Customers" to "Partners" will give you a better perspective on internal product development.
Measuring Feature success (Oct 17): You're building features to solve problems. If you don't know what success looks like, how did you decide on that feature at all?
How I use OKRs (Oct 13): A description of how I use OKRs to guide a team, written so I can send to future teams.