On Fri, Sep 13, 2013 at 11:13 AM, Chris Steipp csteipp@wikimedia.orgwrote:
This of course means that we would condone users giving their username/password to a potentially trojaned desktop application, for the benefit that honest apps would be able to easily store a token instead of the username/password combination and prevent a later attacker from getting full access to a user's account through their password.
Does the community feel like that's a reasonable tradeoff?
I have another idea: application passwords. Google has them. Facebook has them. And they're basically like OAuth tokens except a bit more permanent.
For those not familiar with the concept, Google and others have a section in your account settings that allow you to generate application passwords. You then give this password to the application in lieu of your actual password. Of course, it can be revoked at any time, and it'd be trivial to implement scoping on these application passwords. If anything we could just have them act exactly like OAuth access tokens.
While I do think that there is definitely a bit of trust that goes into giving an application access to your account, there are definitely methods we could employ to avoid letting users give their password directly to an application.
*-- * *Tyler Romeo* Stevens Institute of Technology, Class of 2016 Major in Computer Science www.whizkidztech.com | tylerromeo@gmail.com