[dead]
OAuth for all
121–130 of 174 posts
Re: OAuth for all
#122Earlier quoted context omitted.
For enterprise, the ability to shut out a user with one click is the overriding security feature. I don’t know why anyone wants to use a federated identity to sign into things. Where did the messaging that it’s more secure come from, Google?
Do you remember when people had to "remember" a password for every service they use? It is better to use a trusted third party. Sure these third parties are big corporations, but its safer for most people to have a login that just works, even at the cost of some privacy. People trying to remember passwords is a pretty bad security situation. I'm not an expert but so often folks on here throw criticisms without giving…
A password manager can both take care of remembering unique passwords and allow privacy options
Re: OAuth for all
#123Earlier quoted context omitted.
True they'd know which sites you've signed up to, but not the login times, unless the service emails you every time you log in.
Every time you sign into an app, you get redirected to the auth provider to open a session there. So of course they know your login times.
I don't think you followed the thread. I began discussing the OAuth privacy nightmare, then the counter point was that the with email auth providers know anyway, but they don't know the login times necessarily, unlike with OAuth.
Re: OAuth for all
#124Earlier quoted context omitted.
The last commit to wrangler was 2 hours ago? https://github.com/cloudflare/workers-sdk/tree/main/packages...
That’s exactly the point. Wrangler, being cloudflare’s primary CLI tool, is a microcosm of exactly the problem GP was articulating: it’s focused way more on adding new commands than improving existing ones. Many products, even supposedly “GA” ones, still lack basic operability via wrangler because instead of finishing building out its capabilities to manage existing services, they prioritized adding rudimentary suppo…
I suspect CF is their future CLI.
Re: OAuth for all
#125Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…
What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.
"It's a privacy nightmare."
Privacy nightmare in the real world, "tech" company wet dream in SillyCon Valley
Re: OAuth for all
#126Classic Cloudflare, for all, works well, not too expensive... but, and consequently of all those positive attributes, positioning itself at the center of everything.
i mean. fair trade?
No, consolidation within the tech industry has never been good for workers or open source development. For someone who considers themselves as part of the open source community I've been extremely disappointed how anti-worker and pro-corporation you come across.
Don't worry you aren't unique in this regard, many other nonworking dev influencers say similar things: never championing for workers but somehow always championing positions that help investors + corporations first and foremost
Re: OAuth for all
#127Earlier quoted context omitted.
For enterprise, the ability to shut out a user with one click is the overriding security feature. I don’t know why anyone wants to use a federated identity to sign into things. Where did the messaging that it’s more secure come from, Google?
Do you remember when people had to "remember" a password for every service they use? It is better to use a trusted third party. Sure these third parties are big corporations, but its safer for most people to have a login that just works, even at the cost of some privacy. People trying to remember passwords is a pretty bad security situation. I'm not an expert but so often folks on here throw criticisms without giving…
> its safer for most people to have a login that just works, even at the cost of some privacy.
Respectfully, I disagree in a time when all your data is being slurped up and resold constantly I hate any additional costs to my privacy.
> People trying to remember passwords is a pretty bad security situation.
But that's their problem, not mine. I'm an adult and I use a password manager.
Re: OAuth for all
#128Earlier quoted context omitted.
What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.
"It's a privacy nightmare." Privacy nightmare in the real world, "tech" company wet dream in SillyCon Valley
There's two sides to every coin
Re: OAuth for all
#129Earlier quoted context omitted.
Don't get me wrong but data shows that you will likely fail to keep that api key a as secret and you will also fail to revoke when it becomes necessary. You will definately not going to rotate it frequently as you should. Good thing about the OAuth2/OIDC is these things will not put the trust on the bearer of the api key, but on actual identity that needs to have the access.
My data shows that zaptheimpaler has above average likelihood to keep their secret secret. > Good thing about the OAuth2/OIDC is these things will not put the trust on the bearer of the api key, but on actual identity that needs to have the access. And... you do not see the myriad of problems with that? What about the OIDC provider going rogue or getting compromised? How do you ensure whatever you use to authenticate…
And I also trust myself to keep my secrets better than this whole pretend security theater too.
I've never worked at an organization that handled their user's data/privacy/security even remotely close to how I handle my own and I wouldn't even consider myself all that paranoid. I have worked for some companies that really really should care too - there's just no incentive to really care and those in the org that try too do so will get ignored.
The data breach letters I get in the mail a few times a year back me up on this.
Re: OAuth for all
#130Earlier quoted context omitted.
The last commit to wrangler was 2 hours ago? https://github.com/cloudflare/workers-sdk/tree/main/packages...
That’s exactly the point. Wrangler, being cloudflare’s primary CLI tool, is a microcosm of exactly the problem GP was articulating: it’s focused way more on adding new commands than improving existing ones. Many products, even supposedly “GA” ones, still lack basic operability via wrangler because instead of finishing building out its capabilities to manage existing services, they prioritized adding rudimentary suppo…
Nah, you don't get to claim they don't work on improving their products, and then handwave away actual updates to it with "yeah but those aren't the improvements I wanted". That's just life and priorities.
Abandoning something, and not making the changes you want to see are entirely different things.