OAuth use case

Freshness Warning
This blog post is over 13 years old. It's possible that the information you read below isn't current and the links no longer work.

Alex Barnett rhetorically asks, "OAuth is a big idea, but is it a 'solution looking for a problem to solve'?" and decides that end user problem is real. Here’s an actual use case for the problem and why OAuth solves it.

Deane got tricked by Shelfari when he let them check his Gmail contacts to see if any of them were already members of the service.

Shelfari offered to check his contact list to help him make the social service more useful. All he had to do was put in his GMail user name and password so Shelfari could see his contacts. He took the bait, and Shelfari used his juicy 900 plus member contact list as a way of virally distributing their service. They shot an email out, in Deane’s name, to everybody on his contact list. They made the email sound as if Deane was personally inviting you to join Shelfari.

In Deane’s comments, Dave says "What I don’t understand is what would possess anyone to ever provide their primary email account information to a third party service."

That’s sort of the point behind OAuth. With it, an application can define what activities a third party service can perform, and the end user can decide which of those they’d like to give someone access to.

Google could say that third party services could access your contact list in Gmail, mark items as Spam in Gmail, access your OPML file in Reader, and read your Adsense report data. A third party service named YASN (Yet Another Social Network) could build in OAuth support and ask for access to Gmail contact lists.

You come along and log into YASN, and they tell you they can check your contacts. You decide that sounds nice and you’re sent over to GMail’s site to log in. After logging into GMail, you get asked if you’d like to give YASN access to your contacts. You agree, and YASN gets an auth token they can use to see your contacts, and you end up back on YASN’s site with your contact list.

Later, YASN decides to use that auth token to buy some ads in AdWords—free advertising for them, courtesy of your wallet. But that Auth token doesn’t work for AdWords. Or for reading your email in Gmail. Or for anything else—just for reading your contact list.

You decide later that YASN isn’t for you, and you don’t want them seeing your contacts any more. You can now log into GMail and revoke that auth token they’ve got. Next time they try and get access to your contacts, they’ll be denied—that token isn’t any good now.

One thing about this particular problem of sites emailing your friends on your behalf is that they don’t actually need access to your email account to send email "from" you. That "from" line in your email program isn’t authenticated. You can put anything you want in there and the email will go out. So YASN can still take all your contacts and email them, sticking your name in the From instead of YASN’s.

One way to stop this would be for email providers not to hand over a list of your contact’s email addresses, but to hand over an anonymized hash of the email address instead. If Gmail were to publish in their OAuth spec that they’re going to provide an md5 hash of each email address, then YASN could create hashes of the email address of each of their users, and compare those hashes against the ones that Gmail provides. Now YASN can check for matches in your gmail contact list without having the actual list.

Recently Written

The Trap of The Sales-Led Product (Dec 10)
It’s not a winning way to build a product company.
The Hidden Cost of Custom Customer Features (Dec 7)
One-off features will cost you more than you think and make your customers unhappy.
Domain expertise in Product Management (Nov 16)
When you're hiring software product managers, hire for product management skills. Looking for domain experts will reduce the pool of people you can hire and might just be worse for your product.
Strategy Means Saying No (Oct 27)
An oft-overlooked aspect of strategy is to define what you are not doing. There are lots of adjacent problems you can attack. Strategy means defining which ones you will ignore.
Understanding vision, strategy, and execution (Oct 24)
Vision is what you're trying to do. Strategy is broad strokes on how you'll get there. Execution is the tasks you complete to complete the strategy.
How to advance your Product Market Fit KPI (Oct 21)
Finding the gaps in your product that will unlock the next round of growth.
Developer Relations as Developer Success (Oct 19)
Outreach, marketing, and developer evangelism are a part of Developer Relations. But the companies that are most successful with developers spend most of their time on something else.
Developer Experience Principle 6: Easy to Maintain (Oct 17)
Keeping your product Easy to Maintain will improve the lives of your team and your customers. It will help keep your docs up to date. Your SDKs and APIs will be released in sync. Your tooling and overall experience will shine.

Older...

What I'm Reading

Contact

Adam Kalsey

+1 916 600 2497

Resume

Public Key

© 1999-2021 Adam Kalsey.