Show HN: OAuth.io released with 70+ providers
1–10 of 23 posts
Re: Show HN: OAuth.io released with 70+ providers
#2Nice stuff! Definitely beats using Gigya or Janrain which cost quite a bit. This is the only part we were interested in anyway so...
Are you guys planning on adding services and maintaining the services for regular updates across all these services?
Re: Show HN: OAuth.io released with 70+ providers
#3This is still beta page. I can't see list of 70 providers.
Re: Show HN: OAuth.io released with 70+ providers
#4Previous discussion: https://news.ycombinator.com/item?id=5777102
From a security perspective, this is a horrible idea, adding a completely untrusted intermediary. OAuth.io will technically have access to all of your user data, and any security flaws that they have will impact your service and user data.
Re: Show HN: OAuth.io released with 70+ providers
#5This is still beta page. I can't see list of 70 providers.
Currently, you just have to sign up to access the full list. We'll add this list for non registered user asap. Thanks for your feedback.
Re: Show HN: OAuth.io released with 70+ providers
#6So... Where can I find more information on what this is and how it works? There isn't even a description on the website on what oauth.io is, just a small code snippet. Why am I supposed to sign up for something I know nothing about? I was expecting at least a small video that explains how this all works and what it does for me.
Re: Show HN: OAuth.io released with 70+ providers
#7Previous discussion: https://news.ycombinator.com/item?id=5777102 From a security perspective, this is a horrible idea, adding a completely untrusted intermediary. OAuth.io will technically have access to all of your user data, and any security flaws that they have will impact your service and user data.
Worse than that. You are at the mercy of what service providers think of both them AND all of their clients.
Suppose that they have a customer who uses their service to install malware in people's accounts, and Google catches them. Google isn't going to just shut off one customer. They are going to revoke the client_id associated with OAuth.io, causing every customer to lose access. (A malware author could try this because they would hope that malicious requests are more easily lost inside the torrent of other stuff coming from OAuth.io.)
And it isn't just a customer who is intentionally bad. If a customer gets compromised by a malware author who uses that as a vector, well, same story.
You do not want your access to business-critical APIs to depend on a third party reseller who cannot guarantee their own continued access. Really.
Re: Show HN: OAuth.io released with 70+ providers
#8A bit annoying that the site breaks the back button.
Re: Show HN: OAuth.io released with 70+ providers
#9I clicked the login button on your oauth.io site' and I was surprised to see a basic email/password form. Why not use your own product to allow login through Facebook, twitter, github, etc?
Re: Show HN: OAuth.io released with 70+ providers
#10Previous discussion: https://news.ycombinator.com/item?id=5777102 From a security perspective, this is a horrible idea, adding a completely untrusted intermediary. OAuth.io will technically have access to all of your user data, and any security flaws that they have will impact your service and user data.
Worse than that. You are at the mercy of what service providers think of both them AND all of their clients. Suppose that they have a customer who uses their service to install malware in people's accounts, and Google catches them. Google isn't going to just shut off one customer. They are going to revoke the client_id associated with OAuth.io, causing every customer to lose access. (A malware author could try this b…
I received an invite to this service today and just checked it out - this is not correct.
You have to generate your own keys for each service, then store them with OAuth.io. This doesn't mean they can't access your users' data, just that there isn't one "master key" that could shut everyone down.