I can see from the Hype Machine blog [1] that Plug was developed with the approval and assistance of Hype Machine. Nevertheless, it's unfortunate that the client requires the end user's username and password credentials rather than using an authorization framework like OAuth 2.
Oauth is terrible desktop/mobile UX, and it doesn't provide any real security. A genuinely malicious application can spin up a webview under its control -- or do almost anything else it likes with your account.
As long as passwords are stored in the system's secure keychain, using passwords is not just OK -- it's the right desktop/mobile UX.
The only time OAuth makes sense is on the web, where by the very nature of the web's design, user's passwords would be provided to unrelated 3rd party servers outside the user's control.
Please STOP inflicting OAuth on non-web platform's users.
I'm happy about that. I'd rather have a separate login (with unique password) for each service than log into everything using the same account.
EDIT: I misunderstood the complaint! I thought that they wanted to login using a Google account or something similar rather than having a place in Hype Machine to allow Plug to connect and use a token to pass the permission to the program. Oops! I completely agree with the poster's comment in this case.
You misunderstand. This app requires you type in your password inside it, as opposed to using some form of token from the website (which is how OAuth2 works).
Ah, I thought that they were complaining about not being able to login using a Google account! I will edit my original comment to clarify and hopefully avoid more downvotes.
Fair point. To mitigate this, we never store your password. Basically we exchange your username/password combo for a token from Hype Machine which is used to authenicate requests.
The only data we store are your username and some basic settings in a .plist (`open ~/Library/Preferences/com.Plug.Plug.plist`) and your token which you can view in Keychain Access.app and search Plug.
Nope. We don't support the twitter/fb OAuth login right now. Just plain old username/password. The token we get back is a Hype Machine proprietary thing.
I can see from the Hype Machine blog [1] that Plug was developed with the approval and assistance of Hype Machine. Nevertheless, it's unfortunate that the client requires the end user's username and password credentials rather than using an authorization framework like OAuth 2.
[1] http://blog.hypem.com/2014/04/we-are-9/