Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Obligator – An OpenID Connect server for self-hosters

github.com

Post reply on HN
Print view View original

131–134 of 134 posts

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#131

Post by apitman »

hatf0 wrote: post #130
apitman wrote: post #72

Earlier quoted context omitted.

The Ory stack looks to be very high quality for sure. But so far in this thread there's been mentioned Hydra, Kratos, and Oathkeeper in order to run an OIDC server. You say Hydra is as barebones as you can get, but by itself it has 58 direct dependencies. I'm sorry, it just seems to be targeted at a completely different demographic.

When has the number of dependencies ever directly correlated with the feature set of an application? Have you ever looked at a node_modules folder? More over, how is that relevant in any way? This argument against dependencies has always felt like weird NIH-ism spawned out of the same crowd who still thinks that C is a good programming language. Have fun reinventing the wheel, but I’ll take my dependencies to go. Add…

Dependencies are correlated with complexity in my mind. This is based on my experience, which may be different from yours. My experience with node_modules is actually where I started to become wary of dependencies and try to minimize them in my code. You definitely to be careful of NIH. I find sometimes a better approach is just to cut features.

I think I understand the utilty of the Ory stack. Looks like some excellent kit doing excellent work for a lot of people. But it didn't solve my problems.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#133

Post by kosinus »

apitman wrote: post #107
kosinus wrote: post #87

This looks like it has the same core functionality as Portier? https://github.com/portier/portier-broker I'm on mobile, so haven't really checked where we differ in details.

This looks great! I will definitely be taking a close look. Only thing I noticed with a quick try is that portier allows both a magic link and code for passwordless email login. Magic links are much more vulnerable to attack than codes because the email providers and anyone who may have access to your email can hijack your login from any location. I think it's fine to provide magic links but that choice should be the…

Thanks for pointing that out! Maybe we can improve on that, even if we keep it as a non-goal.

Right away, a partial mitigation for current versions of Portier is to modify the `email_*.mustache` templates to remove the link. But a second piece of information Portier leaks is simply which sites you're logging into. That's right in the subject for Portier, and not something you can customize for current versions.

I think it's worthy to try and harden against this type of attack, but I'm worried the effect is limited. There's often nothing stopping someone from simply starting the login process / creating a new session, so an attacker just has to know where, and there are a bunch of ways to find out.

Re: Show HN: Obligator – An OpenID Connect server for self-hosters

#134

Post by omneity »

apitman wrote: post #113
omneity wrote: post #25

Earlier quoted context omitted.

IndieAuth is super super cool and a vital component to get back control of the internet to users, but I can't shake up the security concerns. Also, near the end of the article. Using a security nightmare such as Wordpress as your identity provider, what could go wrong? It only takes one single rogue plugin.

What security concerns specifically?

Someone breaking into a Wordpress install due to a plugin's 0-day for example, and then being able to log into all the accounts managed by that WP's openID server.
Post reply on HN