<arch.design/>
← Lessons/

OAuth 2.0

1 / 8

The password anti-pattern

The old approach: give a third-party app your actual username and password so it can act on your behalf. Every app that needed access to your data asked for your full credentials and stored them — indefinitely.

  • PROBLEMApp sees your full credentials
  • PROBLEMNo way to revoke access without changing password
  • PROBLEMApp can impersonate you completely
  • RESULTEvery breach exposes everything

Sharing passwords gives apps unlimited, unrevokable access — a fundamentally broken trust model.

← → navigate · S recap