Approaching Access Control on the Web (Part I) • Hacker News Board

Re: Approaching Access Control on the Web (Part I)

#11

Post by mrec » Thu, Aug 30, 2018, 1:21 PM UTC

malachygr wrote: post #2

Hi there! From experience we know how hard auth* systems can be. There are a million ways to get what you want. We also see the issue that developers usually start with a least-effort approach (username + password) which needs refactoring later on. The intention of these articles is to give you an overview of what exists and help you choose the best approach with as much information as you can get. We hope that this…

This looks great! Thanks for putting it together.

(Not convinced about "ultimative" though. I'm assuming you were going for a portmanteau of "ultimate" and "definitive", but I suspect a lot of people are just going to read it as "ultimate" and subsequently remember/Google the wrong thing.)

Re: Approaching Access Control on the Web (Part I)

#12

Post by eganist » Thu, Aug 30, 2018, 1:23 PM UTC

malachygr wrote: post #10

eganist wrote: post #9

Earlier quoted context omitted.

Well, I suppose I'm the first. If I can inquire further: are you open to discussing ORY's revenue model? I love organizationally-backed open source projects pertaining to security as there's a less than savory trend in this space for tools to go unsupported after original maintainers have moved on, but I have a bad habit of loving them less when I can't quite nail the business model of the primary entity supporting t…

Hi, mostly consulting, sponsorship and paid additions to the open source ecosystem. In the future we'll offer managed cloud services. We're not doing open core though, if that's what you're getting at :)

Sponsorship, e.g. Patreon? https://www.patreon.com/_ory

Thanks for the insight!

Re: Approaching Access Control on the Web (Part I)

#13

Post by malachygr » Thu, Aug 30, 2018, 1:31 PM UTC

eganist wrote: post #12

malachygr wrote: post #10

Earlier quoted context omitted.

Hi, mostly consulting, sponsorship and paid additions to the open source ecosystem. In the future we'll offer managed cloud services. We're not doing open core though, if that's what you're getting at :)

Sponsorship, e.g. Patreon? https://www.patreon.com/_ory Thanks for the insight!

Yes, but we're also moving to open collective for this. Patreon is more for individuals while open collective is for open source collectives.

Re: Approaching Access Control on the Web (Part I)

#14

Post by deckar01 » Thu, Aug 30, 2018, 1:32 PM UTC

I recently found out about TLS client authentication via client certificates. It seems like a really secure mechanism for authentication that just doesn't have a standardized UX/API for initial cert exchanging and multiple device registration. I am hesitant to rely on a 3rd party SSO provider to remain available. I would much rather rely on a decentralized technology like the TLS certificate network.

Re: Approaching Access Control on the Web (Part I)

#15

Post by danieka » Thu, Aug 30, 2018, 1:46 PM UTC

malachygr wrote: post #2

Hi there! From experience we know how hard auth* systems can be. There are a million ways to get what you want. We also see the issue that developers usually start with a least-effort approach (username + password) which needs refactoring later on. The intention of these articles is to give you an overview of what exists and help you choose the best approach with as much information as you can get. We hope that this…

Nice :)

The first code example is missing an end ' in the endpoint string. '/some-protected-resource -> '/some-protected-resource'.

Re: Approaching Access Control on the Web (Part I)

#16

Post by jordache » Thu, Aug 30, 2018, 1:52 PM UTC

you missed a main point in your opening paragraph. Security is best not implemented as a custom solution. There are so many things to get wrong and if you do get even a single detail wrong, it could break the entire implementation.

Re: Approaching Access Control on the Web (Part I)

#17

Post by rdli » Thu, Aug 30, 2018, 2:20 PM UTC

Ory's great, and glad to see they're integrating more with other technologies, e.g., https://www.ory.sh/api-access-control-kubernetes-cloud-nativ....

Re: Approaching Access Control on the Web (Part I)

#18

Post by aliswe » Thu, Aug 30, 2018, 2:28 PM UTC

Really nice.

> But authorization does not require authentication, and neither does authentication require authorization.

Can you give an example on this?

* There are a handful of typos scattered through the text, about 5-10 errors

* As I was into learning mode, in the middle of the article I didn't initially notice that the server product you recommending was your own. I think a clarification there is in place

* Server-Side Distributed Applications, I don't have a solid conviction but I can't really see how multiple systems with multiple parallell accounts is a common, viable or even realistic situation...

Re: Approaching Access Control on the Web (Part I)

#19

Post by cmpb » Thu, Aug 30, 2018, 2:28 PM UTC

malachygr wrote: post #2

Hi there! From experience we know how hard auth* systems can be. There are a million ways to get what you want. We also see the issue that developers usually start with a least-effort approach (username + password) which needs refactoring later on. The intention of these articles is to give you an overview of what exists and help you choose the best approach with as much information as you can get. We hope that this…

Have you looked into using Macaroons[1] at all for distributed systems? I used them for a client's multi-site intranet a while back, and it made some of the very complicated parts very simple. I'm just wondering why they never seem to have caught on.

[1] http://hackingdistributed.com/2014/05/21/my-first-macaroon/

Re: Approaching Access Control on the Web (Part I)

#20

Post by mathnmusic » Thu, Aug 30, 2018, 2:29 PM UTC

At the very least, webapps should abstract out registration and login processes into a middleware, instead of building their own. This will make it possible to trivially implement single-sign on and sharing auth infra across various tools - especially open-source.