Netflix doesn't logout other open sessions with password change

authentication passwords password-protection netflix
Brian H picture Brian H · Jan 24, 2014 · Viewed 27.7k times · Source

I've recently been doing a bit of web development so I've been thinking more about authentication and stuff. On Netflix I noticed there is an extra option on the Account page to de-authorize other devices. My girlfriend changed her password but I was still able to use it without re-entering the password till she logged out other devices.

So my question is how does authentication for Netflix work if it doesn't have to locally store your password?

Answer

DaImTo picture DaImTo · Jan 24, 2014

Netflix uses a version of Open autentication to allow a device to access an account. Once the device has been authorized it will then have access to that account until its has been deautorized.

Chaning password doesnt matter becouse the device has autorization already probably in the form of a refresh token stored someplace. So its not storing a password its storing an autorization token of some kind.

Lets use facebook as an example: (response to comment below) 

https://www.facebook.com/settings?tab=applications

This shows a list of all the crap I have loged in to using my facebook account. Now I have probably changed my facebook password sevral times it wont matter I will still have access. Some of these are mobil apps i have installed on my cellphone at one time or another. Even if i dont use them they still have access.

Related questions

How do I login and authenticate to Postgresql after a fresh install?

Did a new install of postgres 8.4 on mint ubuntu. How do I create a user for postgres and login using psql? When I type psql, it just tells me psql: FATAL: Ident authentication failed for user "my-ubuntu-username"

Read More
Salt and hash a password in Python

This code is supposed to hash a password with a salt. The salt and hashed password are being saved in the database. The password itself is not. Given the sensitive nature of the operation, I wanted to make sure everything …

Read More
Best way for a 'forgot password' implementation?

I'm looking for the best method to implement a "forgot password" feature. I come out with 2 ideas: When user click on forgot password, the user is required to key in the username, email and maybe date of birth or last …

Read More