GitHub Has a Permission Problem • Hacker News Board

Re: GitHub Has a Permission Problem

#11

Post by jez » Wed, Mar 17, 2021, 2:16 AM UTC

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks.

But this tidbit struck me as hilariously out of touch:

> Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like that. Instead they'd want very specific permission like, only permission to deposit money, or only permission to read the balance, or only permission to read transactions, etc...

It is so, so much worse than that. Most banks don’t even provide OAuth APIs, so to hack around this third parties just straight up ask for your bank username and bank password so that they can turn around and log into that site and scrape the HTML UIs that come back from logging in.

“I think most people would be super scared of that.” No doubt these people exist (hello!) but like, there’s a whole industry built around this.[1] Possibly the banking example is not the best piece of supporting evidence for the article’s claim.

[1] https://plaid.com/

Re: GitHub Has a Permission Problem

#12

Post by caminocorner » Wed, Mar 17, 2021, 2:20 AM UTC

Compromising a third-party to inject code into your public & private repositories is going to be a future supply-chain compromise similar to Solarwinds

Re: GitHub Has a Permission Problem

#13

Post by remram » Wed, Mar 17, 2021, 2:21 AM UTC

> How many people would click through on "Let ACME corp act on your behalf on your Citibank Account"

Banking is a terrible example because it's literally how it works. Try to link a bank account to PayPal or TransferWise, they'll ask you your username and password for your online account to that bank, and the next screen asks for the verification text you got as they literally log in as you. And ACH, the system your employer uses to direct deposit your salary also allows for withdrawals.

Hopefully security is better where the author is writing from...

Re: GitHub Has a Permission Problem

#14

Post by ibraheemdev » Wed, Mar 17, 2021, 2:25 AM UTC

GongOfFour wrote: post #9

I was hoping this was about gists being publicly accessible even when they are private...

Is that true? Do you have a source for that?

Re: GitHub Has a Permission Problem

#15

Post by niij » Wed, Mar 17, 2021, 2:26 AM UTC

jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

I came to the comments as soon as I read that part. It's funny they probably don't realize that's what FI aggregation at their bank is doing. Screen scraping is a necessary evil until we can get banks in America with APIs.

Re: GitHub Has a Permission Problem

#16

Post by u801e » Wed, Mar 17, 2021, 2:26 AM UTC

jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

I remember this topic coming up at work and I said something along the lines of why would anyone provide their online bank account credentials to another service in order for them to verify your account and other members of my team (all software developers and operations) didn't see a problem with it.

It seems like there's a significant disconnect between what people believe is good security practice.

Re: GitHub Has a Permission Problem

#17

Post by [deleted] » Wed, Mar 17, 2021, 2:28 AM UTC

[deleted]

Re: GitHub Has a Permission Problem

#18

Post by jrochkind1 » Wed, Mar 17, 2021, 2:28 AM UTC

This has been bothering me for a while too.

Without repo-specicific permissions at least, it sort of requires me to have separate github accounts for personal stuff, work stuff, contract stuff (per client) etc, doesn't it?

Even if I'm willing to risk Some Serivce(tm) having write access to all my repos cause I want it for a personal project, I can't ethically give it access to work/client repos too.

And yet, I must. Or have a bunch of different accounts. Who can keep track of that? I think most people just end up, dangerously and arguably unethically, giving a service access to all their client/work projects, when they wanted it on only one of them.

In some cases github via Oauth or whatever is going on seems to give more granular access. I've seen it look entirely different (like entirely different screens) in different contexts I"m auth'ing some third party service. Maybe it's different historical APIs all still in use? I can't keep track of what's going on, it just all confuses me -- which makes it even harder to know if a service is asking for appropriate permissions or not, I'm not really sure what the possiblities are, they seem very inconsistent.

Re: GitHub Has a Permission Problem

#19

Post by l0b0 » Wed, Mar 17, 2021, 2:29 AM UTC

derefr wrote: post #6

> Reading public info should not even be listed! It's already obvious that all your public info can be read by the app. That's the definition of public! There's no reason to tell me it might read it. It doesn't need permission to do so. This is the permission you grant apps using GitHub for SSO, that allows GitHub to know what account you're logged in as . The information itself is public (anyone could scrape it from…

In other words, the problem is with describing secret information as "public".

Re: GitHub Has a Permission Problem

#20

Post by u801e » Wed, Mar 17, 2021, 2:30 AM UTC

remram wrote: post #13

> How many people would click through on "Let ACME corp act on your behalf on your Citibank Account" Banking is a terrible example because it's literally how it works. Try to link a bank account to PayPal or TransferWise, they'll ask you your username and password for your online account to that bank, and the next screen asks for the verification text you got as they literally log in as you. And ACH, the system your…

> Try to link a bank account to PayPal or TransferWise, they'll ask you your username and password for your online account to that bank

I don't remember having to do that for paypal. I do remember them asking for the routing and account number and that they asked me to verify the cash amount of a deposit they made in order to confirm the account.

I went through a similar procedure when I added my bank account as an external account to my E-trade account. I never had to provide my online banking credentials (though it was an option, I opted to verify deposit amounts instead).