Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Every day I find more sites using social media sharing tools such as AddThis. I love the idea - click on the little button and the link gets posted to Facebook, Twitter or Digg.

But, I am required to provide my sign-in credentials. There is no way that this is secure. Basically, I am providing my information to a third party and trusting them to do the right thing. But, they could be writing the usernames and passwords in a big database and giving that info to the NSA.

Am I missing something here?

share|improve this question
up vote 4 down vote accepted

No, you're not missing anything - I think you've summed up the problem in a nutshell.

If you want to use these services you have to trust that they aren't going to misuse your data. The only way you could know for sure would be to able to inspect their systems, and they aren't going to allow that.

As Patrick Harrington states in his answer there are mechanisms whereby the 3rd party doesn't see your login details, but you still have to trust that they are using them correctly.

So either hope that they are above board and use their services, or assume a level of distrust and don't.

share|improve this answer

I think it depends - if the third party is utilizing Facebook or Twiiter's oAuth authentication, they are never actually seeing your login. They are passing off a token to Twitter (for example), and then Twitter tells the third party "yeap, this person is who they say they are."

That being said, there are still many services out there that are still using basic authentication, and for all you know they could be storing your login in a database somewhere.

share|improve this answer
    
Is there any way - as a "mortal" user - to understand and recognize the difference between oAuth using apps and those that don't? – David Schmitt Oct 6 '09 at 6:37

protected by Community Oct 7 '15 at 6:43

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.