Lion Cipher Lab
Audit and revoke third-party app access to your own accounts
- Identity & Access Management
- Beginner
- ~30-45 min
- Free · no account required
Why it matters
Over the years you have almost certainly clicked a blue 'Sign in with Google', 'Continue with Microsoft', or 'Connect your account' button -- to try a new app, link a calendar, let a tool post for you, or just skip making yet another password. Each of those clicks may have handed an outside app ongoing access to part of your account, and most people never take it back. That is the quiet problem this lab fixes. When you use one of those buttons you are using OAuth: an industry-standard way to let one app get LIMITED access to your account on another service WITHOUT giving it your password. The…
What you'll learn
- what OAuth, a consent screen, a scope, a token, and a connected app actually are, in plain words
- the difference between 'Sign in with Google/Microsoft/Apple' and an app you granted ongoing access to your data
- finding the connected-apps / authorized-apps page on Google, Microsoft, GitHub, and a social account (exact click paths)
- reading what an app can do -- turning a scope like 'See and download all your Google Drive files' into a plain risk you can judge
- recognizing an over-permissioned or forgotten grant, and why a standing grant is a risk even when you never use the app
- revoking an app's access on your own account and confirming it is gone
- the habit of auditing your connected apps on a schedule so grants do not pile up and outlive their purpose
- why revoking a grant is different from deleting the app, and what still happens to data the app already copied
Steps in this lab
- Learn the words: OAuth, consent screen, scope, token, connected app
- The safety rules for this lab
- Why a forgotten grant is a standing risk (the point of the whole audit)
- Audit Google: open your account's connected-apps page
- Audit Microsoft: apps and services that can access your data
- Audit GitHub: authorized OAuth apps and GitHub Apps
- Audit the rest: 'Sign in with Apple' and your social accounts
- REVOKE the stale and over-permissioned grants -- and confirm
- Make it a habit, and where to go next