Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth for all

blog.cloudflare.com

Post reply on HN
Print view View original

21–30 of 174 posts

Re: OAuth for all

#21

Post by spaghettifythis »

willtemperley wrote: post #18
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

Though given most people use gmail or outlook, the two main oauth providers (Google and Microsoft) will know anyway

Re: OAuth for all

#22

Post by asdfsa32 »

weird-eye-issue wrote: post #14
asdf88990 wrote: post #3

Cloudflare turning into a Cloud platform is undoing what it was really doing well: making small clouds and diy hosting manageable in the hostile web environment. Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on.

> Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on. Wait so what do you think their core offering is?

DDoS Protection?

Re: OAuth for all

#23

Post by willtemperley »

spaghettifythis wrote: post #21
willtemperley wrote: post #18

Earlier quoted context omitted.

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

Though given most people use gmail or outlook, the two main oauth providers (Google and Microsoft) will know anyway

True they'd know which sites you've signed up to, but not the login times, unless the service emails you every time you log in.

Re: OAuth for all

#24

Post by asdfsa32 »

rozenmd wrote: post #19
asdf88990 wrote: post #3

Cloudflare turning into a Cloud platform is undoing what it was really doing well: making small clouds and diy hosting manageable in the hostile web environment. Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on.

Cloudflare free is the business model: https://blog.cloudflare.com/cloudflares-commitment-to-free/

If you carefully read the article, it just explain how it is an economic decision, and one which sooner or later will be no longer the case once they can capitalise on with anything above free, which is the lowest of the lowest bars.

But even to entertain this is crazy, not because of decades of history of capitalist and market enterprise in general, but very specific cases of Technology Companies starting with these kind of feel good ideas and declaring "Don't be evil" or things like " access, safety, and shared prosperity" as their core ideals, turn into absolute panopticon and collaborate with unjust killing of women and children in less than a decade.

The market isn't for free.

Re: OAuth for all

#25

Post by messe »

jurgenaut23 wrote: post #17
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

I am tempted to agree with you because I could never quite wrap up my head around it, but I never had to implement OAuth beyond a brief skim through the doc for my own understanding. I always thought this complexity was there for some good reason (security?).

> was there for some good reason (security?).

To cover the myriad of (sometimes downright stupid) requirements that large enterprises have.

Re: OAuth for all

#26

Post by kordlessagain »

weird-eye-issue wrote: post #14
asdf88990 wrote: post #3

Cloudflare turning into a Cloud platform is undoing what it was really doing well: making small clouds and diy hosting manageable in the hostile web environment. Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on.

> Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on. Wait so what do you think their core offering is?

Man-in-the-middle everything.

Re: OAuth for all

#28

Post by vintermann »

willtemperley wrote: post #18
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

Your OAuth provider can also vouch for anyone who pretends to be you, if they so desire. They can give access to anyone, including themselves.

Re: OAuth for all

#29

Post by userbinator »

willtemperley wrote: post #18
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

Centralised identity is basically the government... and having some other entity behave the same way is not good.

Re: OAuth for all

#30

Post by sandeepkd »

codebje wrote: post #5
sandeepkd wrote: post #4

Not sure whats the play here, there is no world where this can turn out good. Cloudflare is more or less infrastructure provider, this idea of some user delegating permissions to their account to some third party client for infrastructure is ripe for abuses. If companies like AWS are not doing it then its for a good reason.

How different is this to, eg, the Google developer program, in which I can create a new OAuth client for Google users?

OAuth2, to be more precise, is a protocol which can be used both for authentication (verifying the user) and authorization (accessing resources on behalf of that user).

Most people in CIAM (customer identity, individuals owing their account instead of representing a company) only interact with OAuth client for authentication. They do not give access of their google account to some THIRD PARTY COMPANY.

Post reply on HN