title: How to keep the OAuth consumer secret safe, and how to react when it's compromised?
body: <p>This question is about trying to understand the security risks involved in implementing oauth on a mobile platform like Android. Assumption here is that we have an Android application that has the consumer key/secret embedded in the code.</p>
  
  <p>Assuming a consumer secret has been compromised, and a hacker has gotten a hold of it, what are the consequences of this ?</p>
  
  <p><strong>Compromised Consumer Secret assumptions</strong><br>
  Am I correct in stating that a compromised consumer secret as such has no effect on the user's security, or any data stored at the OAuth enabled provider that the user was interacting with. The data itself is not compromised and cannot be retrieved by the hacker. </p>
  
  <p>The hacker would need to get a hold of a valid user access token, and that's a lot harder to get.</p>
  
  <p><strong>What could a hacker do with a compromised consumer secret ?</strong><br>
  Am I also correct in stating the following : </p>
  
  <ul>
  <li>The hacker can setup/publish an
  application that imitates my app. </li>
  <li>The hacker can attract users that will go
  through the OAuth flow, retrieving an
  access token via the hackers OAuth
  dance (using the compromised consumer
  key/secret). </li>
  <li>The user might think
  he's dealing with my app, as he will
  see a familiar name (consumer key)
  during the authorization process.</li>
  <li>When a consumer issues a request via
  the hacker, the hacker can easily
  intercept the access token, and
  combined with the consumer secret can
  now sign requests on my behalf to
  gain access to my resources.</li>
  </ul>
  
  <p><strong>End-user impact</strong><br>
  In the assumption that </p>
  
  <ul>
  <li>a hacker has setup an application /
  site using my consumer secret </li>
  <li>one of my users was tricked into authorizing
  access to that application / site</li>
  </ul>
  
  <p>The following might happen :</p>
  
  <ul>
  <li>the end-user may being noticing that something fishy is going on, and inform the service provider (ex: Google) about the malicious app  </li>
  <li>the service provider can then revoke the consumer key/secret</li>
  </ul>
  
  <p><strong>OAuth consumer (my application) impact :</strong><br>
  My app (containing the consumer secret) would need to be updated, as otherwise all my clients would not be able to authorize my application do to requests on their behalf anymore (as my consumer secret would no longer be valid).</p>
  
  <p><strong>Delegating all OAuth traffic</strong><br>
  Although it would be possible to delegate a lot of the OAuth interactions via an intermediate webserver (doing the OAuth dance and sending the access token to the user), one would have to proxy all service interactions also, as the consumer key/secret is required for signing each request. Is this the only way to keep the consumer key/secret outside of the mobile app, and stored in a more secure place on the intermediate webserver ?</p>
  
  <p><strong>Alternatives</strong><br>
  Are there alternatives for this proxy-ing ? Is it possible to store the consumer secret at the intermediate webserver, and have some kind of mechanism that the Android application (published in the market and properly signed), can do a secure request to the intermediate webserver to fetch the consumer secret and store it internally in the app ? Can a mechanism be implemented that the intermediate webserver "knows" that this is an official android app that is requesting to fetch the consumer secret, and that the intermediate webserver will only handout the consumer secret to that particular android app ?</p>