OAuthHub: Mitigating OAuth Data Overaccess through a Local Data Hub

• URL: http://arxiv.org/abs/2603.10056v1
• Date: Mon, 09 Mar 2026 18:43:12 GMT
• Title: OAuthHub: Mitigating OAuth Data Overaccess through a Local Data Hub
• Abstract summary: OAuthHub is a development framework that leverages users' personal devices as the intermediary controller for OAuth-based data sharing between cloud services.<n>Key innovations of OAuthHub are: (1) the insight that discretionary data access is largely unnecessary for most OAuth apps; and (2) a development framework that requires explicit declarations of intended data access.
• Score: 8.302146576157497
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Most OAuth service providers, such as Google and Microsoft, offer only a limited range of coarse-grained data access. As a result, third-party OAuth applications often end up accessing more user data than necessary, even if their developers want to minimize data access. We present OAuthHub, a development framework that leverages users' personal devices as the intermediary controller for OAuth-based data sharing between cloud services. The key innovations of OAuthHub are: (1) the insight that discretionary data access is largely unnecessary for most OAuth apps, which typically only require access at three well-defined moments-during installation, in response to user actions, and at scheduled intervals; (2) a development framework that requires explicit declarations of intended data access and supports the three common access patterns through intermittently available personal devices; and (3) a centralized runtime permission model for managing OAuth access across providers. We evaluated OAuthHub with three real-world apps on both PCs and mobile phones and found that OAuthHub requires moderate changes to the application code and imposes insignificant performance overheads. Our study with 18 developers showed that participants completed programming tasks significantly faster (9.1 vs. 18.0 minutes) with less code (4.7 vs. 15.8 lines) using OAuthHub than conventional OAuth APIs.

Related papers

• KeyPooling: Measuring Where LLM API Relay Paths Collapse Prompt Cache Isolation [53.952294884822955]
  Large language model (LLM) API relays authenticate customers separately but often forward requests through shared provider credentials.<n>We present KeyPooling, a measurement method that traces customer identity through cache lookup and write.<n>We derive a defense contract: every customer must enter a provider-enforced domain.
  arXiv  Detail & Related papers  (2026-08-18T08:12:34Z)
• A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem [1.6774701449274187]
  The Model Context Protocol (MCP) has become the de-facto interface for connecting LLM agents to enterprise tools.<n>Within a year, large organizations went from zero to dozens of internally built MCP servers.<n>This paper reports an industry deployment that resolves the crisis with a centralized MCP gateway.
  arXiv  Detail & Related papers  (2026-08-11T10:19:20Z)
• State of Passkey Authentication in the Wild: A Census of the Top 100K sites [1.5822425915135876]
  Passkeys are discoverable WebAuthn credentials synchronised across devices.<n>Major vendors have integrated passkeys into operating systems and browsers.<n>Yet the true extent of adoption across the broader web remains unknown.
  arXiv  Detail & Related papers  (2026-02-16T19:28:55Z)
• DeepXiv-SDK: An Agentic Data Interface for Scientific Literature [60.19264121557117]
  DeepXiv-SDK is a three-layer agentic data interface for scientific literature.<n>DeepXiv-SDK supports the complete ArXiv corpus, and is synchronized daily to incorporate new releases.
  arXiv  Detail & Related papers  (2026-02-14T23:07:28Z)
• The OpenHands Software Agent SDK: A Composable and Extensible Foundation for Production Agents [46.254487394746725]
  We present the OpenHands Software Agent SDK, a toolkit for implementing software development agents.<n>To achieve flexibility, we design a simple interface for implementing agents that requires only a few lines of code in the default case.<n>For security and reliability, it delivers seamless local-to-remote execution portability, integrated REST/WebSocket services.
  arXiv  Detail & Related papers  (2025-11-05T18:16:44Z)
• Capability-Based Multi-Tenant Access Management in Crowdsourced Drone Services [6.395706521671925]
  Verifiable Credentials (VCs) securely encode claims about entities.<n> standardized protocols for VCs are lacking, limiting their adoption.<n>We integrate VCs into OAuth 2.0, creating a novel access token.
  arXiv  Detail & Related papers  (2025-05-02T06:46:47Z)
• Infogent: An Agent-Based Framework for Web Information Aggregation [59.67710556177564]
  We introduce Infogent, a novel framework for web information aggregation. Experiments on different information access settings demonstrate Infogent beats an existing SOTA multi-agent search framework by 7%.
  arXiv  Detail & Related papers  (2024-10-24T18:01:28Z)
• Beyond Browsing: API-Based Web Agents [58.39129004543844]
  API-Based Agents outperform web Browsing Agents in experiments on WebArena.<n>Hybrid Agents out-perform both others nearly uniformly across tasks.<n>Results strongly suggest that when APIs are available, they present an attractive alternative to relying on web browsing alone.
  arXiv  Detail & Related papers  (2024-10-21T19:46:06Z)
• Unified Singular Protocol Flow for OAuth (USPFO) Ecosystem [2.3526458707956643]
  We propose a new approach for OAuth ecosystem that combines different client and grant types into a unified singular protocol flow for OAuth (USPFO) USPFO aims to reduce the vulnerabilities associated with implementing and configuring different client types and grant types. It provides built-in protections against known OAuth 2.0 vulnerabilities such as client impersonation, token (or code) thefts and replay attacks through integrity, authenticity, and binding audience.
  arXiv  Detail & Related papers  (2023-01-29T17:22:02Z)
• mPSAuth: Privacy-Preserving and Scalable Authentication for Mobile Web Applications [0.0]
  mPSAuth is an approach for continuously tracking various data sources reflecting user behavior and estimating the likelihood of the current user being legitimate. We show that mPSAuth can provide high accuracy with low encryption and communication overhead, while the effort for the inference is increased to a tolerable extent.
  arXiv  Detail & Related papers  (2022-10-07T12:49:34Z)
• Federated Learning-based Active Authentication on Mobile Devices [98.23904302910022]
  User active authentication on mobile devices aims to learn a model that can correctly recognize the enrolled user based on device sensor information. We propose a novel user active authentication training, termed as Federated Active Authentication (FAA) We show that existing FL/SL methods are suboptimal for FAA as they rely on the data to be distributed homogeneously.
  arXiv  Detail & Related papers  (2021-04-14T22:59:08Z)
• Federated Learning of User Authentication Models [69.93965074814292]
  We propose Federated User Authentication (FedUA), a framework for privacy-preserving training of machine learning models. FedUA adopts federated learning framework to enable a group of users to jointly train a model without sharing the raw inputs. We show our method is privacy-preserving, scalable with number of users, and allows new users to be added to training without changing the output layer.
  arXiv  Detail & Related papers  (2020-07-09T08:04:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.