Need someone to lead product management at your software company? I create software for people that create software and I'm looking for my next opportunity. Check out my resume and get in touch.

OAuth use case

Freshness Warning
This blog post is over 16 years old. It's possible that the information you read below isn't current and the links no longer work.

Alex Barnett rhetorically asks, "OAuth is a big idea, but is it a 'solution looking for a problem to solve'?" and decides that end user problem is real. Here’s an actual use case for the problem and why OAuth solves it.

Deane got tricked by Shelfari when he let them check his Gmail contacts to see if any of them were already members of the service.

Shelfari offered to check his contact list to help him make the social service more useful. All he had to do was put in his GMail user name and password so Shelfari could see his contacts. He took the bait, and Shelfari used his juicy 900 plus member contact list as a way of virally distributing their service. They shot an email out, in Deane’s name, to everybody on his contact list. They made the email sound as if Deane was personally inviting you to join Shelfari.

In Deane’s comments, Dave says "What I don’t understand is what would possess anyone to ever provide their primary email account information to a third party service."

That’s sort of the point behind OAuth. With it, an application can define what activities a third party service can perform, and the end user can decide which of those they’d like to give someone access to.

Google could say that third party services could access your contact list in Gmail, mark items as Spam in Gmail, access your OPML file in Reader, and read your Adsense report data. A third party service named YASN (Yet Another Social Network) could build in OAuth support and ask for access to Gmail contact lists.

You come along and log into YASN, and they tell you they can check your contacts. You decide that sounds nice and you’re sent over to GMail’s site to log in. After logging into GMail, you get asked if you’d like to give YASN access to your contacts. You agree, and YASN gets an auth token they can use to see your contacts, and you end up back on YASN’s site with your contact list.

Later, YASN decides to use that auth token to buy some ads in AdWords—free advertising for them, courtesy of your wallet. But that Auth token doesn’t work for AdWords. Or for reading your email in Gmail. Or for anything else—just for reading your contact list.

You decide later that YASN isn’t for you, and you don’t want them seeing your contacts any more. You can now log into GMail and revoke that auth token they’ve got. Next time they try and get access to your contacts, they’ll be denied—that token isn’t any good now.

One thing about this particular problem of sites emailing your friends on your behalf is that they don’t actually need access to your email account to send email "from" you. That "from" line in your email program isn’t authenticated. You can put anything you want in there and the email will go out. So YASN can still take all your contacts and email them, sticking your name in the From instead of YASN’s.

One way to stop this would be for email providers not to hand over a list of your contact’s email addresses, but to hand over an anonymized hash of the email address instead. If Gmail were to publish in their OAuth spec that they’re going to provide an md5 hash of each email address, then YASN could create hashes of the email address of each of their users, and compare those hashes against the ones that Gmail provides. Now YASN can check for matches in your gmail contact list without having the actual list.

Recently Written

Mastery doesn’t come from perfect planning (Dec 21)
In a ceramics class, one group focused on a single perfect dish, while another made many with no quality focus. The result? A lesson in the value of practice over perfection.
The Dark Side of Input Metrics (Nov 27)
Using input metrics in the wrong way can cause unexpected behaviors, stifled creativity, and micromanagement.
Reframe How You Think About Users of your Internal Platform (Nov 13)
Changing from "Customers" to "Partners" will give you a better perspective on internal product development.
Measuring Feature success (Oct 17)
You're building features to solve problems. If you don't know what success looks like, how did you decide on that feature at all?
How I use OKRs (Oct 13)
A description of how I use OKRs to guide a team, written so I can send to future teams.
Build the whole product (Oct 6)
Your code is only part of the product
Input metrics lead to outcomes (Sep 1)
An easy to understand example of using input metrics to track progress toward an outcome.
Lagging Outcomes (Aug 22)
Long-term things often end up off a team's goals because they can't see how to define measurable outcomes for them. Here's how to solve that.

Older...

What I'm Reading

Contact

Adam Kalsey

+1 916 600 2497

Resume

Public Key

© 1999-2024 Adam Kalsey.