Every day I find more sites using social media sharing tools such as AddThis. I love the idea - click on the little button and the link gets posted to Facebook, Twitter or Digg.

But, I am required to provide my sign-in credentials. There is no way that this is secure. Basically, I am providing my information to a third party and trusting them to do the right thing. But, they could be writing the usernames and passwords in a big database and giving that info to the NSA.

Am I missing something here?


No, you're not missing anything - I think you've summed up the problem in a nutshell.

If you want to use these services you have to trust that they aren't going to misuse your data. The only way you could know for sure would be to able to inspect their systems, and they aren't going to allow that.

As Patrick Harrington states in his answer there are mechanisms whereby the 3rd party doesn't see your login details, but you still have to trust that they are using them correctly.

So either hope that they are above board and use their services, or assume a level of distrust and don't.


I think it depends - if the third party is utilizing Facebook or Twiiter's oAuth authentication, they are never actually seeing your login. They are passing off a token to Twitter (for example), and then Twitter tells the third party "yeap, this person is who they say they are."

That being said, there are still many services out there that are still using basic authentication, and for all you know they could be storing your login in a database somewhere.

  • Is there any way - as a "mortal" user - to understand and recognize the difference between oAuth using apps and those that don't? – David Schmitt Oct 6 '09 at 6:37

protected by Community Oct 7 '15 at 6:43

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.