Clarify data breach risk with OAuth about privacyguides.org HOT 1 OPEN

You should also mention things like Facebook OAuth and login security. This process grants 3rd party apps the ability to use your session tokens to takeover your account. This is common and many people assume "I've been hacked!!!1!". In reality, the app has stolen your session, and can use this to do any number of things. It can masquerade as you. It can gather details that can help pivot to fraud, in some cases.

Facebook login is a huge danger because it offers convenience over privacy and security.

For example, see their own documentation of the process:

• exposure to malware and spammers
• leaking tokens in your dev environment, if you use it for your own app
• token hijacking
• stale tokens tend to be vulnerable
• cross-site request forgery (CSRF)
• malicious redirects (malware delivery)

The list goes on. This is just for Facebook OAuth, but it applies to any OAuth entity.

When a malicious app (or "PUP", potentially unwanted program) gains a foothold, it can use that access to not only escalate its own permissions but exfiltrate data from your app or your account on the intended destination. It can then gather phone numbers, addresses, etc. in an attempt to get control of your email and phone (SIM swap) to prevent fraud alerts from reaching you.

Be careful with OAuth.

"multiple accounts are managed by a single login" seems like an oversimplification, because it applies to both the pros and cons of OAuth, and because it leaves you open to the above risks.

from privacyguides.org.