Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub Has a Permission Problem

games.greggman.com

Post reply on HN
Print view View original

111–120 of 130 posts

Re: GitHub Has a Permission Problem

#111

Post by chimbosonic »

jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

Its funnier when you know that banks are actually planning on sharing data via something similar to Oauth. Its called Open Banking PSD2.

Re: GitHub Has a Permission Problem

#112

Post by megous »

chimbosonic wrote: post #111
jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

Its funnier when you know that banks are actually planning on sharing data via something similar to Oauth. Its called Open Banking PSD2.

Even better, banks in may country are banding together to create identity provider for the web. So basically you will be able to use their super-secure login to online banking based on the state of the art SMS second factor and localhost port probing via the web browser (/s), to identify yourself on the web (up to AML level), sign contracts, or access government services.

https://bankovni-identita.cz/o-projektu/

Security of this project is anyone's guess. They certainly have a lot of flashy websites to lure people in, but actual documentation is behind a signup wall. Each bank will create its own independent IdP infrastructure, so this is gonna be a lot of fun for security researchers to be sure.

After this is done, it seems like I'll already be registered with 6 online IdPs (not all of these are banks) that will be able to identify me enough to allow online communication with the government services.

This proliferation of IdPs is getting quite scary...

Re: GitHub Has a Permission Problem

#113

Post by chha »

kalleboo wrote: post #92
thayne wrote: post #75

Earlier quoted context omitted.

It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.

These things exist in other countries. E.g. with e-Invoicing in Sweden, your electricity company, credit card company etc send the bill to your bank, it shows up as a PDF in your online banking, and you confirm or deny it there. If you want it to be auto-confirmed (e.g. utility bills), that's a setting on the bank end of things, not the utility end of things.

A similar thing exists in Norway. For auto-payments you have to register every agreement in the web portal of the bank*, and only after that can they withdraw money automatically. You can also set limits on how much they can withdraw per month, and if you suspect that something is fishy you can cancel the registration forcing them to send you an invoice electronically or on paper.

Re: GitHub Has a Permission Problem

#114

Post by nikisweeting »

forrestthewoods wrote: post #30

What is the best example of fine grain permission UX? Everything I’ve seen skews towards this style of overly broad permission. What are good examples that GitHub should learn from?

I’m not a Facebook fan in general, but this is something FB has actually nailed. They let you check and uncheck each permission or piece of info to share directly from the oauth screen.

Re: GitHub Has a Permission Problem

#115

Post by TechBro8615 »

garaetjjte wrote: post #22
jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide AP…

It’s the Uber/Airbnb model. Plaid does something totally unacceptable as a trade off for a good service. Eventually the bank APIs will catch up, Plaid will become secure, and they’ll have the dominant market position with a high cost of entry.

Re: GitHub Has a Permission Problem

#116

Post by pjungwir »

jez wrote: post #11

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…

Let's not let that be an excuse to settle for poor security, either from Github or our banks.

I agree the way Plaid/Yodlee/etc ask for passwords is insane. I've "closed the tab" several times when I hit that. Just the other day I got asked for my bank passwords for a mortgage refinance. I refused and they said I could send them bank statements instead.

On the other hand, if I want to access a customer's CI pipeline there's no one at Semaphore I can email to find a more-secure workaround. I have to grant access to my whole Github account. As a freelancer with a lot of clients, that's a big problem for me.

Re: GitHub Has a Permission Problem

#118

Post by jrochkind1 »

judge2020 wrote: post #90
jrochkind1 wrote: post #18

This has been bothering me for a while too. Without repo-specicific permissions at least , it sort of requires me to have separate github accounts for personal stuff, work stuff, contract stuff (per client) etc, doesn't it? Even if I'm willing to risk Some Serivce(tm) having write access to all my repos cause I want it for a personal project, I can't ethically give it access to work/client repos too. And yet, I must.…

The correct way is either you join their GH org (which is the best method in terms of IP ownership as well) or you create a GH org for each contract and set up apps with access to only relevant repos in that org.

It's not clear to me how that helps, but you're probably right it does. But I feel like some things have gotten access to a token via a web-auth procedure such that they have access to anything my account does, across organizations.

I swear I have seen flows that ask me to give them that, and don't let me even limit to certain organizations.

But I may be misunderstanding, for sure.

The real problem is that i just don't understand github's auth model for third-party api access. So I have trouble understanding what the possiblities are, what permissions I"m granting, and if they were the minimum permissions the app could have asked for or not. Every time I go through it, it seems to be different than the time before.

Re: GitHub Has a Permission Problem

#119

Post by pdimitar »

jart wrote: post #54

> But if you allow them blanket access to your github (or gitlab), YOU SHOULD ARGUABLY BE DISQUALIFIED FROM BEING A SOFTWARE DEVELOPER!!! The author would probably have himself professionally disbarred if he knew what Disqus was doing with his blog. Which is why I think we should be more forgiving of mistakes than what his tone proposes. GitHub obviously has room to improve, but ultimately the system runs on trust, a…

Anyone who would abuse this overly wide access given to their org (by the dev) wouldn't make a single bleep about it and just keep scraping data and code quietly until the door is shut in front of their face. So I don't think your idea about how this should work is good.

If somebody wants to just shovel other organization's code into their silo then they are not incentivized to attack the current state of affairs; on the contrary, they are benefiting from them, why would they say anything at all?

> The author would probably have himself professionally disbarred if he knew what Disqus was doing with his blog.

I agree that we should be conscious of security in all things and apply universal standards but your comment comes off as a whataboutism and a discussion stopper.

We can and should address the security issues one by one. That a lot of things are broken does not mean we should throw our hands in the air and give up, no?

Re: GitHub Has a Permission Problem

#120

Post by pdimitar »

philsnow wrote: post #70

Yes GitHub has this problem, but it's not a GitHub problem, it's an oauth problem. Oauth is better than the previous state of the art (either app-specific passwords that can do anything you can do or else literally just your own username and password), but it has a huge UX problem around least privilege. In general it's very opaque what the requested permissions can be used to do. Some companies get this pretty right…

Is there a problem using Sandstorm today? I followed it some years ago but never actually tried it, always too busy. :(
Post reply on HN