How does one use oauth in a FLOSS app where we can't keep a secret key? If other see the secret and the key, can't he use it to use the user account as if he where me?
-
What do you mean, "can't keep a secret key"? "there is no trustworthy place to store it"? Which "other" are you talking about?– Piskvor left the buildingSep 1, 2010 at 12:15
-
@piskvor: if it's open source, how can it hide the secret key? You can just retrieve it the same way the app does. "other" means an unauthorized third party. Someone could take the app key and use it to impersonate the app and get the user's data?– Roberto AlsinaSep 1, 2010 at 12:19
-
"Open source" is a way of licensing, meaning approximately "if you are further distributing the program, you must pass the source code to the recipients" not "if you are using the program, you must allow anyone to see your source code, as it is on your servers". You don't have to give/show the source to anyone, as long as you're not distributing it.– Piskvor left the buildingSep 1, 2010 at 12:23
-
@Piskvor Open Source means the source code can be seen by anyone. We're talking about writting an Open Source app here.– Juanjo ContiSep 1, 2010 at 12:26
-
This is a desktop application, the code is running in the user's computer, not on a server.– Roberto AlsinaSep 1, 2010 at 12:30
1 Answer
I have dealt with the issue in my own open source Twitter apps.
You do NOT distribute the ConsumerKey or ConsumerKeySecret with your source code. A reasonable approach is to create two constants/global variables (or whatever) that hold these values, and these are EMPTY in the source that you publish. Include some documentation that explains to other developers how to acquire their own keys and how to modify the source to install them.
If you are distributing compiled binaries, you would compile with the ConsumerKey and ConsumerKeySecret values populated so the application runs.
There is no -perfectly secure- way to handle this; it's the nature of OAuth. You can, however, be -reasonably- secure, and that's what this approach achieves.