开发者

OAuth on mobile apps

开发者 https://www.devze.com 2023-03-09 23:14 出处:网络
I want to create an Android application that takes advantage of Facebook and Twitter.I was planning on using OAuth but the more I think about the less confident I become in this being the best solutio

I want to create an Android application that takes advantage of Facebook and Twitter. I was planning on using OAuth but the more I think about the less confident I become in this being the best solution. My concern is with the Consumer Secret key, the one used to authenticate the application. I can safely store the Access Token's secret key because if that gets compromised the user just needs to reauthenticate and they have a new one; however, if the consumer secret gets compromised, my application as a whole gets compromised across all devices since it is app, not user, specific. This is fine for web apps since it is stored on a secure central server, but for mobile apps where it is installed in multiple devices it seems dangerous. I don't like the idea of h开发者_如何学Goaving that consumer key sitting on a number of devices just waiting to be compromised. So, I guess my question is should I be going with OAuth or is there some other better method out there.


We use OAuth without any problems. Also see here:

http://blog.oauth.net/2009/04/22/acknowledgement-of-the-oauth-security-issue/

0

精彩评论

暂无评论...
验证码 换一张
取 消