#1

I have recently deployed an application featuring Twitter Oauth.

My question/concern is that since my service/application is geared towards artists, and well, artists can be expressive and speak their minds. Speaking from experience here. :grin::innocent: As such, they tend to get their accounts suspended/banned for things they say on Twitter.

When that occurs, does this suspension impact their sign-in with my application as well with Oauth? That is, is a suspended Twitter (main site) user also suspended from using my application as well via their Twitter Oauth registration?

Thank you for any assistance/insight you can provide.

Best Way to Test Oauth Authentication with a Banned/Suspended User?
#2

As far as i know, yes

#3

Thank you for your reply. That is my assumption/expectation as well, but I have not found any actual documentation to confirm this, which is what led me here. Do you by chance have a resource that provides additional information around this?

#4

Hello again,

I wanted to check in with this issue. Is there a way we can escalate this to someone who would know to provide a more definitive answer?

This does pose a larger question for those applications dependent on OAuth2. Perhaps something to address in OAuth3. Consider that I am running a business where money is being transferred from these accounts, and these accounts can store value. If they are blocked for something that did not occur on my site/application, then this becomes a problem when they start complaining to me about not accessing their accounts and associated stored value.

Currently, the recommendation is to “chain” another OAuth2 provider (e.g. Microsoft/Google), but this is complex and not ideal.

It would be great to get clarity around this. Thank you for any continued assistance you can provide.

1 Like
#5

I’m not twitter so i definitely can’t speak for that.

#6

No worries @IgorBrigadir I appreciate you taking the time and letting me know. I figured you are not a direct agent for Twitter (but if you were all the better :grin:). Rather, I was hoping we could escalate it somehow to find out. As these threads appear to lock after only 14 days, that does sort of put a timer on things to find out, hence my urgency. I guess I can nag-bump here until it’s resolved.

FWIW I have tried pinging TwitterDev on Twitter itself in the past, but it seems they are so overwhelmed that they cannot answer.

1 Like
#7

If your concerned about third party authentication locking users out of your site, you should provide email/password as an authentication method.

#8

Thank you for the reply @abraham. I am aware of email/password but I, unfortunately, find them more trouble than they are worth. Doing so forces me to be a custodian of information that can be hacked/leaked/sold.

#9

I have been thinking about this further, and @abraham does provide an interesting path to explore.

Note that in addition to the issues mentioned earlier, email/password as an authentication method allows for actors to automate account creation, which is arguably just as bad as storing information that can be targeted by breach. While I could attempt to protect from this scenario by way of CAPTCHA, it is not well liked and hinders overall experience (there are Gieco commercials being made making fun of it, after all).

I would very much prefer to simply route that to the Oauth2 provider as they are much better aware, prepared, and hardened for such a scenario. Not to mention, they provide better protection with the use of SMS/phone and the like.

OK that stated, while Email/password is not an authentication method for my system, I do allow users to register email addresses for notifications (note that this is opt-in and not forced on the user upon sign-in).

Additionally, I do offer the ability to register a two-factor application such as Authy. So the idea is: if authentication occurs and is successful via Oauth2 provider, but the profile is suspended/blocked, then I would offer a screen that allows the user to further confirm via registered email or 2FA. If either of these methods pass, then the user is marked as authenticated for their current session.

However, testing this is a bit tricky. I would ideally need to create a profile and set it to suspended status and test from there.

(Also note that it is still unclear if this issue even exists as no one has been able to conclusively state what exactly happens when a profile is in a suspended state. :slight_smile: )

Any further guidance/suggestions would be appreciated.

#10

FWIW branching this issue out for amplification/assistance:
(I cannot post actual links boo)

1 Like
#11

Bumping for awareness.

#12

Well the folks at aspnet-contrib aren’t really all that aware of what happens on a suspended account, either.

I am half-way tempted to create a burner account and partake in some dubious activities to get to the real dirt on this topic. :stuck_out_tongue:

It’s super surprising that no one really knows anything about this… :man_shrugging:

#13

It’s super surprising that no one really knows anything about this…

*Bumping for awareness*

#14

Bumping for awareness

#15

Bumping for awareness

#16

Bumping for awareness

#17

There is existing reports that suspended users can not authenticate with your app.

1 Like
#18

Bummer… I don’t like the answer, but I definitely like and appreciate you taking the time to help out, @abraham. I’m like @dragon_khoi and would like to see if there’s some way of getting this rectified/addressed/changed/improved. As more and more sites onboard to Oauth this is going to become more and more of a concern, especially if you are keeping people from being able to access stored value/monies.

It would also further be useful/valuable to be able to test with a configured suspended/banned account to validate our own user signin experiences.

#19

Moved my new question here:

Thank you again to @abraham + @IgorBrigadir for all your help here. :+1:

1 Like