Sign in with Google: how OAuth lets an app in without your password
Sign in with Google: why an app should never ask for your Google password
An app only wants a look at your Google Calendar, and asks for your Google password to get it. Why saying yes would hand over far more than a calendar.
-
1
Miva hosts a supper club for her friends, and finding a date used to take weeks of messages. So Rono built a small app for it, supperclub.example. It looks at everyone's Google Calendar and finds an evening when all of you are free.
-
2
To look at your calendar, the app needs a way into your Google account. The plain way would be to ask for your password. Around 2008, big websites really did this: type your email password, and we will find your friends in your contacts.
-
3
But your password does not open only your calendar. It opens your email, your photos, your files, even the page where the password is changed. Whoever holds it can do everything you can.
-
4
And it stays. The app has to keep your password to use it again next month. So a break-in at one tiny app would hand a stranger the key to your whole Google account.
-
5
Changed your mind? The only way to take your password back is to change it, and that cuts off every other app you gave it to as well. You cannot say no to just one.
-
6
So the app needs something much smaller than your password, with these three promises. A way called OAuth gives an app exactly that, and it starts with a button you have seen a hundred times.
-
Go further
A few names behind the story.