q
GitHub Has a Permission Problem
101–110 of 130 posts
Re: GitHub Has a Permission Problem
#102This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
Banking is not secure. The bank industry is held together by strings of rules and regulations that, fortunately, very few people are willing to pull at.
Re: GitHub Has a Permission Problem
#103Earlier quoted context omitted.
It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.
Unauthenticated credit/debit transfers are a pretty uniquely American thing. Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) before the money moves.
And looks like author lives in Tokyo, not sure where is he from. The only time I pay with credit card and give power for others to pull automatically money from there is American companies.
Otherwise I always do the wire or approve the é-bills manually.
Re: GitHub Has a Permission Problem
#104I ran into this recently on Gitlab. Gitlab has these amazing deployment tokens that can dole out read-only access to individual repos and yet if I want to deploy from a Gitlab repo to Netlify I have to give Netlify full access to all my repos. That's beyond dumb.
Re: GitHub Has a Permission Problem
#105Earlier quoted context omitted.
It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you. Which means if Plai…
> You would report the fraud, and you would get your money back. There's a time limit on this, though, right? So if you're not checking your account every N days, you could still get screwed?
Yes. At least in Germany (but I believe it's the same for all SEPA transactions), it's eight weeks for the simplified return where you just tell your bank "get that money back, please" and it's pretty much instantly credited to your account. That applies regardless of the legal status of the transaction.
For non-authorized transactions, you have 13 months to recover the money. Since it will have cleared after eight weeks, the whole procedure takes considerably longer and most bank employees will not be too familiar with it.
I had recently experienced that when somebody used my bank account to sign up for Netflix. I only caught it after three months (I mostly blame my bank for not providing a "new ACH transactions" report). Netflix wasn't helpful (and apparently has no interest in stopping this, their fraud detection allowed for creating an account with the legal name "f f", a German bank account and a none-German IP) and my bank immediately reversed the last two transactions (still within eight weeks window). The first one took about three months, but I don't know who or what was responsible for the delay.
Re: GitHub Has a Permission Problem
#106Earlier quoted context omitted.
It could still be a lot better though. For example, there could be an oauth-like flow where you confirm to your bank that you authorize paying the merchant the amount listed. It seems like banks would be motivated to have something like that since it would reduce the chances of them having to pay out for fraud.
Unauthenticated credit/debit transfers are a pretty uniquely American thing. Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe) before the money moves.
> Many other countries have bank transfers that require the customer to authorize it (either ahead of time, or synchronously during the transaction, as you describe)
Only half-correct if you're talking about SEPA. Legally, the customer has to fill out a "SEPA direct debit mandate" - but the company initiating the direct debit transfer only has to keep it on file.
I have a business account at my bank, I can theoretically file a direct debit for as much money as I want against any SEPA-reachable bank account (in practice, most banks including mine limit that amount until you can prove, e.g. via presenting a bill, that this is a correct amount) - but if someone disputes it or, worse, files a legal complaint that causes police to investigate and I can't produce that mandate signed/authorized by the customer, I'm in extremely hot water.
Re: GitHub Has a Permission Problem
#107This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide AP…
There’s just very little way around it :/ if I want to transfer money between different banks or services it’s usually much faster by giving out your creds. Worse, if I want to do my taxes Turbotax simplifies that whole process tremendously if I give them creds for all my financial services... it’s pretty crazy how much trouble you must be willing to accept to avoid leaking your creds.
Re: GitHub Has a Permission Problem
#108Earlier quoted context omitted.
It's not, though. The legal system, and your bank will protect you in this scenario. You would report the fraud, and you would get your money back. In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you. Which means if Plai…
> You would report the fraud, and you would get your money back. There's a time limit on this, though, right? So if you're not checking your account every N days, you could still get screwed?
US ACH rules are 60 days for consumer accounts, and 3 for business accounts.
Re: GitHub Has a Permission Problem
#109Can we now talk about docker hub requiring write access to your repositories as well? This is an awful situation and tons of projects on github have given up on this front and just allowed full access to their repo
Re: GitHub Has a Permission Problem
#110Blog writers have problem problems. I'm not just annoyed by the title. The "problems" are generally feature requests sold as bugs.
The blog post describes a relevant security issue, especially given how many hacks and other issues we have seen over the last years with compromised browser extension repositories, widely-used npm packages and the likes.
And it's compounded by many years of users being trained to blindly accept the "Authorize user to do X Y Z" prompts all over the Internet.