[deleted]
GitHub Has a Permission Problem
31–40 of 130 posts
Re: GitHub Has a Permission Problem
#32Hah, I ran into this guy on the support forum thread about this issue: https://github.community/t/why-does-this-forum-need-permissi...
I'm on his side - I think the copy is bad - but he was pretty unhelpful in the thread and ended up getting it locked.
Re: GitHub Has a Permission Problem
#33> Reading public info should not even be listed! It's already obvious that all your public info can be read by the app. That's the definition of public! There's no reason to tell me it might read it. It doesn't need permission to do so. This is the permission you grant apps using GitHub for SSO, that allows GitHub to know what account you're logged in as . The information itself is public (anyone could scrape it from…
In other words, the problem is with describing secret information as "public".
GitHub phrases the permission as something like “This app can view your public email address.”
The “public” there is GitHub distinguishing which of the email addresses associated with your account it is exposing to the app. One of a GitHub account’s email addresses can be set to be publicly shown on your GitHub profile. Other email addresses can also be associated with your account (for login/recovery), but these are private. The permission only allows the app access to the public one, not the private one.
Really, it’s not the “email address” in the grant description that would properly be qualified by “private.” It’s the “your.”
But granting the app permission to know the logged-in GitHub user’s numeric ID, isn’t part of any of the permission scopes, but is instead the base permission the app gets when you click “Accept” on the app binding request. The only thing the “view your email address” permission allows is for the app to look up the primary public email address (if one exists!) for the GitHub account with the ID it now already knows, given a successful OAuth callback.
Technically, just having the GitHub ID is enough to SSO you against GitHub, in the oldschool OpenID sense of SSO (or to track you across the internet.) The implicit default scope of an app grant already breached the privacy of “your.” So the additional permission about emails doesn’t have to qualify anything, because it’s not giving anything still private away. It’s just protecting something actually public from being mapped to from the private credential the app, at that point, already has access to. It’s putting up a roadblock in one direction of a lookup that could be done entirely without the API (by scraping user’s profile pages for internal user IDs + email addresses, and building a table indexed by user ID.)
Re: GitHub Has a Permission Problem
#34I’m not sure when the Forestry-GitHub integration came to be but Forestry was launched in 2016 and GitHub Apps was launched in 2017.
Their problem (refined permissions / permission to a single repo) can seemingly be solved by migrating to GitHub Apps but, at the time they launched, there was no way for them to ask for permission to a single repo.
So now there are two problems: - GitHub Apps is a bit of a mess in terms of user experience from both the product side and user-facing side - Forestry has probably looked at this problem and said “we will make more money by losing out on customers who don’t sign up due to code access vs spending months refactoring the core concepts of our product”.
Eventually, GitHub will become more strict in OAuth vs GHA and then become more strict with what it allows on its platform (similar to what Google has done with Chrome extensions recently).
But at the end of the day, GitHub probably doesn’t care THAT much. If you don’t agree with the permissions, don’t install the app and/or put pressure on the product to refine their permissions. It’s tough to know the lost revenue due to these issues so give them incentive to change.
Re: GitHub Has a Permission Problem
#35This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide AP…
I mean PayPal still right now today does it for the “verify your bank account” feature.
Re: GitHub Has a Permission Problem
#36This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transaction for my account number in their nightly batch, the money just flies right out.
Re: GitHub Has a Permission Problem
#37This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
I, too, clicked through into the comments as soon as I read that bit, wondering whether someone else had the same reaction as me.
As a UK citizen who's lived in the states for the last 4 years, the permissions that Venmo and other financial apps require is even more horrifying than the rest of the US financial system ("tell us what tax you think that you owe, and if you're wrong, you go to prison" // "you have to build up credit in order to be able to afford anything - but if you ever fail to pay it off, you'll be in debt for the rest of your life").
Re: GitHub Has a Permission Problem
#38The biggest problem I have with the Github auth flow is around organizations. An organization can prevent my apps from accessing its repos, but I can't deny an app permission to access organizations that I don't want it to. As a freelancer, when some client uses a Github app to do something, I have to give that Github app access to all of my other client's organizations, because Github won't let me disable them.
Yes, as a contributor or member of a few different technical groups with GitHub organizations, I feel the same way. Those groups don’t want me using app X on their repos, and neither do I!
Re: GitHub Has a Permission Problem
#39> Reading public info should not even be listed! It's already obvious that all your public info can be read by the app. That's the definition of public! There's no reason to tell me it might read it. It doesn't need permission to do so. This is the permission you grant apps using GitHub for SSO, that allows GitHub to know what account you're logged in as . The information itself is public (anyone could scrape it from…
And also a lot of info is publicly available on the website but you still need an API token to access it programmatically. You could scrape it, sure, but that is not officially supported.
Re: GitHub Has a Permission Problem
#40Github does have repo-specific permission grants. The app in question is probably not using it, but it is possible. Here's what that consent screen looks like - https://docs.github.com/assets/images/install_permissions.pn....
You do NOT have to give access to your entire account/organization to a well-built app.