Where Can I Deauthorize OAUTH Connected Services (Such as IFTTT)?

[Timmy256]

Hi guys,

As topic; where can I deauthorize third-party services that I've connected to my account, such as IFTTT? i've looked all over for it without any luck.

When connecting, it takes me to an URL in the format of: oauth.netgear.com, but I've found no other link in the Arlo interface to see what services are currently connected and how to revoke their access.

Hopefully there's a way and this wasn't overlooked, because if not, it would be quite a security issue.

Thanks.

[Timmy256]

Hi @JamesC,

I haven't tried changing the password, as that should have nothing to do with the IFTTT service. The OAUTH token should be agnostic to my Arlo account credentials. Imagine if it's implemented as you suggest, changing the password would void all the token for third-party services connected to the Arlo account of all the users...

I'll try and let you know, since I don't care about reconnecting to IFTTT. But that would be a wrong implementation and completely troublesome for all the users that actually use IFTTT; specially if this hasn't been announced anywhere, you would receive a lot of complains of people not knowing why IFTTT (or other connected providers; if available - I don't know) stopped working when they changed their password.

[Timmy256]

Hi @JamesC, just wanted to confirm you that changing the password blocked the access from IFTTT to the Arlo account. Even though it shouldn't work that way (the third party service should be agnostic to the first party password changes; since it already has it's token authorized), I don't mind because I won't be using IFTTT anymore.

Ironically enough, changing the password on the web didn't make the prompt appear for the new password when using the mobile app. Shouldn't it have required it? How do I stop somebody stealing my phone from accesing my account? Pretty scary stuff; even worse than the IFTTT security flaw.

[Dr55]

Please tell us you are working on this serious security issue. There really is a need to have a consolidated view and management to all OAuth connected services as Timmy stated. While waiting please confirm a solid way how to disable all active Oauth tokens attached to your account. Also could you comment on Timmy’s last observation that changing password on web portal does not prevent access from mobile app with the old password.

[ppassera]

Hello, has this been solved? Is there any web page where we can manage Oauth access to our Netgear/Arlo account?

Regards,

Pablo

[Higi]

Can anyone comment has this topic reached the development team? This sounds like very severe security consern and if Arlo team is as security oriented as they claim to be I would expect some comment.

[JamesC]

Currently, there is no web page to manage access for third party integrations. Changing your Arlo account password will deny third party applications access to your Arlo system.

If you would like to see this expanded on with a web page to manage access, I encourage you to post your idea in the Arlo Idea Exchange so other uses can support the idea by adding Kudos.

JamesC