Up until now it seems that when you register on a random web site you do so with blind trust.

You assume that the site isn't harvesting information and passwords. You assume the site is reasonably secure. And you also assume that the information you've submitted isn't used in an undesireable way.

More recently, it's become possible to connect up to a site with a Google+ or Facebook account. But that brings along another problem. Anyone that has access to the social account can access anything that's linked to it.

So, has any thought gone into making something that's truly independant ? Something like an information locker a person could set up themselves. Do any relevant projects exist ?

  • 5
    Why would you make those assumptions? The Internet is not a friendly place.
    – beatgammit
    Commented Jul 27, 2013 at 5:27

1 Answer 1


When we login using Facebook or Google or Twitter, the protocol used is OAuth. OAuth makes it easier to use existing profiles in new ones, but only a limited set of information is shared, in most cases only your email id.

However when the site you are logging into is registered as a Facebook "app" it can request a lot of information from Facebook including rights to post on your behalf. That is bad.

There are many OAuth providers, and if required you can setup your own. If you have your own server, you can use apache amber or other server side software to setup your own authorization service. When you go to a site, it will have an option for specifying your custom OAuth provider (most sites do, if they don't then bad luck). Provide your OAuth url and you will be able to login with your own domain's authorization.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.