“There’s an app for that,” but not all apps are created equal. Users expect there to be an endless amount of applications to make their lives easier, but they forget to take into account what kind of security measures those applications provide.
In addition, these applications and services often connect to other applications and services, meaning if a user gives one application access to their credentials, they are also giving the other connected services access. While developers are all too familiar with the implications a data breach will have on their application’s reputation, few of them are taking advantage of the tools designed to prevent them.
OAuth is an open, secure data sharing standard designed to protect user data by providing access to that data, but keeping a user’s identity private. The standard was created in 2006, and updated to version 2.0 in 2012. Top technology companies such as Google, Yahoo, and Amazon have moved towards OAuth 2.0 for authentication and authorization purposes. But despite its benefits, not enough developers are moving toward the standard.
SD Times spoke with Jim King, chief security officer for the financial data company Finicity, to talk about why developers should care about the OAuth 2.0 standard.
What is the importance of OAuth 2.0 in the app industry?
King: OAuth 2.0 is the most secure data sharing standard on the market. The two-factor nature and use of tokenization prevents the single factor disclosure of accounts — a less secure method that was used in the past with 1.0. The single-factor authentication method, which backed up a single credential on sites like Google Drive or file servers, was easy to compromise since hackers only needed to obtain the one piece of information to gain access. OAuth 2.0 requires more levels of authentication to give access to a user. OAuth 2.0 is also important because it is an open standard designed specifically with app developers in mind.
How long has this version of OAuth been around and what type of improvements have been made to 2.0?
OAuth 2.0 has been around since 2012 and was created just two years after OAuth 1.0. The second version has quite a few differences, such as increased OAuth flows and short-lived tokens, and it is not backwards compatible with 1.0. Instead, OAuth 2.0 is a new-and-improved 1.0. Its biggest benefits are that it is more streamlined, less complicated and easier to build into an app.
If OAuth 2.0 was developed in 2012, why is this something we are still talking about or something that developers still need to be aware of?
We’re exchanging, using and storing more data than ever before. It’s not even been six years, but the difference between the world of data then and now is night and day. OAuth 2.0 is relevant now more than ever because it’s still the most secure option on the market, and there is still room for adoption. The fact that it’s been around five years, and that no better alternative has replaced it, is remarkable in the tech space and shows just how useful and well-made it is.
How does OAuth 2.0 exactly help organizations secure data?
Tokens associated with access – as with other data – can be given or stolen if not secured properly. While OAuth makes authentication relatively secure, it’s only as strong as the refresh interval or the method in which it is secured. Otherwise bad actors can “borrow” or use the token before a refresh cycle to impersonate the intended user. The beauty of OAuth lies in the fact that tokens can easily and quickly be revoked by the server side as needed due to account suspension or abuse of the service.
Why haven’t all apps transitioned to OAuth 2.0?
Many companies and developers don’t embrace the security OAuth 2.0 provides until after they need it — for example, after a data breach. Part of the reason adoption has been slow is that some companies think OAuth 2.0 is vendor-centric and there is a large cost associated with it. However, companies can do it themselves and develop in-house. For example, here at Finicity we are using our own OAuth server to simplify our processes and reduce spend. Additionally, we are leveraging OAuth as a secure means of accessing financial data from some of the largests institutions in North America.
What do some apps use instead?
SAML and OpenID are well-known alternatives to OAuth 2.0, but they are primarily used for enterprise applications. Comparatively, OAuth 2.0 is a full authentication framework and is leveraged primarily for API or third-party based solutions. Therefore, the best choice of solution usually depends on how it will be used.
How can app developers implement OAuth 2.0?
Implementing OAuth 2.0 is pretty easy for an experienced developer, however there are multiple steps to implementing the solution. Instead of typing all the steps out, I’ve linked to a resource here that spells out the process in detail.
What else should software developers be aware of when it comes to OAuth 2.0?
In light of recent breaches like Yahoo and Equifax, security is more important than ever. Developers need to be proactive in their approach and focus on security as an inherent part of their job description. OAuth 2.0 is a great step in the right direction, and developers would be wise to leverage OAuth 2.0 in every app they can bolt it on to.
