The biggest problem I have with the Github auth flow is around organizations. An organization can prevent my apps from accessing its repos, but I can't deny an app permission to access organizations that I don't want it to. As a freelancer, when some client uses a Github app to do something, I have to give that Github app access to all of my other client's organizations, because Github won't let me disable them.
GitHub Has a Permission Problem
21–30 of 130 posts
Re: GitHub Has a Permission Problem
#22This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials).
I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide APIs in PSD2 directive.
Re: GitHub Has a Permission Problem
#23My YC company is a GitHub app [1] and the "act on your behalf" thing is just a really poorly written message for the new (github apps vs oauth apps) apps interface. There's even a hilarious thread on the github forum itself about "act on your behalf" when all it requests is your email and avatar [2]
Ironically the newer apps system does have fine grained permissions, but seems more intrusive because of the strange wording
[2] https://github.community/t/why-does-this-forum-need-permissi...
Re: GitHub Has a Permission Problem
#24This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
I remember this topic coming up at work and I said something along the lines of why would anyone provide their online bank account credentials to another service in order for them to verify your account and other members of my team (all software developers and operations) didn't see a problem with it. It seems like there's a significant disconnect between what people believe is good security practice.
[deleted]
Re: GitHub Has a Permission Problem
#25I noticed this problem a while ago when I wanted to use DockerHub’s automated image build service. Per the docs https://docs.docker.com/docker-hub/builds/link-source/ you need to grant DockerHub access to your entire GitHub organization!
For me, this was a full stop dealbreaker. A work around was to create a separate GitHub org just to use with the dockerhub build service, but frankly that’s a terrible hack that just masks the larger problem.
Re: GitHub Has a Permission Problem
#26This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
Looking at their FAQ, mwave seem to have ceased this practice but they had a thriving online business at the time I wrote this:
https://lolware.net/2016/11/17/requesting_bank_login.html
Everybody single person who provided feedback on this blog argued I was "being pedantic about nothing", "throwing your fedora at them", and even at American Express they took very seriously the "get your money back" angle but seemed confused as to why I didn't want to hand passwords out.
Re: GitHub Has a Permission Problem
#27The biggest problem I have with the Github auth flow is around organizations. An organization can prevent my apps from accessing its repos, but I can't deny an app permission to access organizations that I don't want it to. As a freelancer, when some client uses a Github app to do something, I have to give that Github app access to all of my other client's organizations, because Github won't let me disable them.
I would say make per-client Github accounts, but that's stupidly painful to manage too. It would be nice if they could do what Google does with multiple accounts being logged in being supported (though, that implementation has warts, too).
Re: GitHub Has a Permission Problem
#28[deleted]
Re: GitHub Has a Permission Problem
#29My YC company is a GitHub app [1] and the "act on your behalf" thing is just a really poorly written message for the new (github apps vs oauth apps) apps interface. There's even a hilarious thread on the github forum itself about "act on your behalf" when all it requests is your email and avatar [2] Ironically the newer apps system does have fine grained permissions, but seems more intrusive because of the strange wo…
I realize that the thread is even by the same author as OP as well!
Re: GitHub Has a Permission Problem
#30What is the best example of fine grain permission UX? Everything I’ve seen skews towards this style of overly broad permission. What are good examples that GitHub should learn from?