Hacker News Reader

Comment by balls187 | Hacker News Reader

> If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow.

OAuth isn't identity management, it's for authorization.

Each of those platforms does provide it's own identity management, but that isn't OAuth.

View on HN

The OAuth based OpenID Connect is for identity management.

http://openid.net/connect/

Personally, I still prefer Persona's privacy-oriented approach to id management, but since Mozilla stopped pushing it, development has slowed quite a bit and widespread adoption will probably never happen.

https://www.mozilla.org/en-US/persona/

I took that to mean use both identity management as well as OAuth.

1. Why use OAuth unless you want to grant 3rd parties access to your services data, on behalf of your customers?

2. Security best practices subject to "open for interpretation."

While OAuth isn't "for" authentication, everyone uses it that way by "authorizing" access to "view your email address" which is as good as authenticating your email address.

Can you link to implementations that use OAuth in such a manner?

GitHub How To: https://developer.github.com/guides/basics-of-authentication... And the OpenID Connect standard (essentially OAuth V2 + identity service): http://openid.net/connect/

> Why use OAuth unless you want to grant 3rd parties access to your services data, on behalf of your customers?

So, what would you use instead?

> Why use OAuth unless you want to grant 3rd parties access to your services data, on behalf of your customers?

Can you explain me this? How Google will be able to access my service data?

I think he may have confused OAuth with OpenID (which are often used in a complementary fashion).

Reply on news.ycombinator.com