David Recordon

"This really isn't true as a blanket statement. There are many things which I can do with someone's password – such as change it – which service providers do not expose via their APIs. Further companies like Facebook and Google give users even more fined grain control over what an application can and cannot do with their account and data via OAuth (1.0 and 2.0). Even Twitter lets applications ask for read only access which is much less than could be done with someone's password. I don't disagree that using OAuth is strictly more difficult for desktop application developers than just prompting for a person's username and password. That said, "When you grant an application access with OAuth, you are giving them the same power you would with your username and password." is not true across the board." - David Recordon