Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth for all

blog.cloudflare.com

Post reply on HN
Print view View original

31–40 of 174 posts

Re: OAuth for all

#31

Post by iririririr »

jurgenaut23 wrote: post #17
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

I am tempted to agree with you because I could never quite wrap up my head around it, but I never had to implement OAuth beyond a brief skim through the doc for my own understanding. I always thought this complexity was there for some good reason (security?).

far from it! it was just designed by comitee who both future proofed it and made sure it worked on low powered devices from 1971.

i make a point to implement oauth from scratch, because using the overly complex libraries expose you to bugs such as attacker sending a token which the metadata just says "no encryption or signature. trust me bro", which is actually part of the spec if you combine some options.

while in the real world, if google or apple sends you a token that is not always the same signature cypher (one of a dozen by the spec) you are better of threating as malicious, because it pretty much is. a manual implementation of a token consumer is about 20 lines... including downloading the provider keys and checking it (which most startups never do! allowing anyone to just sign a token as anyone)

Re: OAuth for all

#32

Post by Exoristos »

You'd think implementing OAuth2 were splitting the atom the way so many dev teams won't even consider rolling their own or using the multiple well-tested free libraries.

Re: OAuth for all

#33

Post by iririririr »

the end game: they will start requiring proof of id to access resources they host.

probably getting ahead of something the UK and some us states will require soon, as they already require from the sites behind cloudflare.

Re: OAuth for all

#34

Post by sandeepkd »

ok_dad wrote: post #6
sandeepkd wrote: post #4

Not sure whats the play here, there is no world where this can turn out good. Cloudflare is more or less infrastructure provider, this idea of some user delegating permissions to their account to some third party client for infrastructure is ripe for abuses. If companies like AWS are not doing it then its for a good reason.

Do you understand what OAuth is? It’s like an API key but less likely to be abused. This is a good thing. It helps security in many ways and makes security flows more safe than carrying around a token.

I really feel sad about the state of security and its bit hard to unwrap in one paragraph which makes it more challenging. Let me try to be bit more verbose

Cloudflare API Keys - You create them and then use those keys directly against cloudflare API's to manage services/infrastructure in your account. How you create the keys is may be a different kind of challenge.

OAuth flow in discussion here - You are using a third party service (which registers themselves as a the client application with cloudflare), this service is going to prompt you for OAuth flow and redirect to Cloudflare, not (only) to authenticate you but it will get a access token on your behalf (your cloudflare account) from Cloudflare. Whatever this THIRD PARTY service uses this token for your behalf is going to incur infrastructure cost for your account.

Re: OAuth for all

#35

Post by utopiah »

Classic Cloudflare, for all, works well, not too expensive... but, and consequently of all those positive attributes, positioning itself at the center of everything.

Re: OAuth for all

#36

Post by jofzar »

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

We had a security report for a oauth vuln and it was the worst thing I have ever read, the whole thing is like spaghetti that "just works" until it doesn't because you feed it something similar.

Never want to touch oauth, it's a fucked spec.

Re: OAuth for all

#37

Post by ZiiS »

sandeepkd wrote: post #4

Not sure whats the play here, there is no world where this can turn out good. Cloudflare is more or less infrastructure provider, this idea of some user delegating permissions to their account to some third party client for infrastructure is ripe for abuses. If companies like AWS are not doing it then its for a good reason.

AWS do exactly this. An example use-case is IAM can grant permission to update a Lambda to a Github action running in a given repository.

Re: OAuth for all

#39

Post by NicoJuicy »

asdf88990 wrote: post #3

Cloudflare turning into a Cloud platform is undoing what it was really doing well: making small clouds and diy hosting manageable in the hostile web environment. Once their revenue from Cloud services overtakes their core offering, bye bye Cloudflare free and so on.

You don't know Cloudflare?

Their first products were production grade examples of the SDN that required a lot of bandwidth (DDOS/CDN).

The cloud is a logical continuation.

Their business was always the "internet", see their ticker => NET.

Dev free is part of the marketing cost and would stay under the current leadership.

Re: OAuth for all

#40

Post by rcarmo »

Nice, but as usual if you want a 3-step “getting started” example you have to wade through the docs, and even then…
Post reply on HN