OAuthHub: Mitigating OAuth Data Overaccess through a Local Data Hub#
PETS 2026 digest Program Core pick 20–25 July 2026
Authors: Qiyu Li (University of California, San Diego), Yuhe Tian (University of California, San Diego), Haojian Jin (University of California, San Diego)
- Why: OAuth over-granting is a chronic production problem — relying parties request broad scopes, users press Allow, and tokens hoover up data forever. A mitigation paper from Jin's group (which works on usable system security at UCSD) addresses the day-to-day OAuth design question every platform PM faces.
- What: Apparently a client-side "local data hub" that sits between OAuth flows and relying parties, mediating and limiting the data actually released so that granted scope doesn't equal unlimited access (title/author line only — no abstract in program).
- How: Inference from the title: an on-device broker that intercepts token/data handoffs, enforces least-privilege per request, and possibly surfaces granular revocation to the user.
- Where applicable: Consumer OAuth/OIDC ecosystems on personal devices (browser or mobile). Browser- or OS-integration dependent; not a server-side-only fix.