Gallery

How far can we trust apps?

Posted on 27 Oct 2009 at 14:25

Davey Winder wonders if we trust apps and web services a little more than we should

While waiting for companies to adopt such initiatives, if they ever do, it will, he says, “be up to the user to decide who to trust for the foreseeable future”.

I find it useful to think about this in terms of US-style valet parking. Many luxury cars now come with a valet key as well as the regular key: give the parking guy the valet key and he can drive the car only for a mile or so, can’t open the boot, or use many of the in-car functions such as the mobile phone.

The valet gets restricted access to the vehicle using a special key in order to perform a particular function on your behalf, while you keep the real key that unlocks everything. Isn’t a valet key just what’s needed in the world of third-party applications that access online services? I believe it is, and so do the people who are providing such a key via "the OAuth project, an open protocol that allows secure and standardised API authorisation from desktop and web applications.

Isn’t a valet key just what’s needed in the world of third-party applications that access online services?

OAuth got off the ground at the back end of 2006 during ongoing work on an OpenID implementation for Twitter. Several developers got together to discuss the possibility of using OpenID alongside the Twitter API to delegate authentication, and discovered that there wasn’t any open standard for such API access delegation.

Fast-forward to the middle of 2007 when Google got interested in the idea, and the final draft for the OAuth Core 1 was released by the end of the same year. The main protocol has now been finalised, libraries are available for platforms including PHP, .NET and C, and OAuth is being implemented by the likes of Twitter, which is good news.

It means that if an application’s developer supports it, you can securely exchange authorisation data between its application and a web service without exposing your login information to the third-party developer at all. The OAuth key is a token that grants access to a particular site in order to use particular resources for a particular period of time.

I can therefore use an application that requires access to my Twitter account, safe in the knowledge that said application won’t store my login data on its servers and add another layer of insecurity to the privacy onion.

I like the simplicity of OAuth – as an end user all you need do is authorise a login via Twitter and let OAuth take care of the rest. More power to Twitter’s elbow for supporting it, and to Google, which supports it across all the Google Data APIs including Calendar, Blogger and Picasa Web Albums.

Of course, OAuth isn’t a magic bullet and cannot guarantee security or privacy: that depends on the implementation at the end of the day, so there’s still no getting away from the value of trust. But OAuth allows your trust to spread a little wider than it might without it.

Download a year of Davey Winder's Online Security columns by heading to our Free Downloads site