Information protection when registering on web sites

Question

Up until now it seems that when you register on a random web site you do so with blind trust.

You assume that the site isn't harvesting information and passwords. You assume the site is reasonably secure. And you also assume that the information you've submitted isn't used in an undesireable way.

More recently, it's become possible to connect up to a site with a Google+ or Facebook account. But that brings along another problem. Anyone that has access to the social account can access anything that's linked to it.

So, has any thought gone into making something that's truly independant ? Something like an information locker a person could set up themselves. Do any relevant projects exist ?

Answer 1

When we login using Facebook or Google or Twitter, the protocol used is OAuth. OAuth makes it easier to use existing profiles in new ones, but only a limited set of information is shared, in most cases only your email id.

However when the site you are logging into is registered as a Facebook "app" it can request a lot of information from Facebook including rights to post on your behalf. That is bad.

There are many OAuth providers, and if required you can setup your own. If you have your own server, you can use apache amber or other server side software to setup your own authorization service. When you go to a site, it will have an option for specifying your custom OAuth provider (most sites do, if they don't then bad luck). Provide your OAuth url and you will be able to login with your own domain's authorization.