Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth for all

blog.cloudflare.com

Post reply on HN
Print view View original

131–140 of 174 posts

Re: OAuth for all

#131

Post by Saris »

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

Plus I feel like it has completely ruined typical login flows, normally a PW manager would auto fill the username + password fields, but thanks to oauth we often get only a username field, or have to click 'login with password' or some other silly step first.

Re: OAuth for all

#132

Post by rockskon »

zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

OAuth 2.0 is a hate crime against security given its complexity.

Re: OAuth for all

#133

Post by luka2233 »

willtemperley wrote: post #18
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

I wouldn't call it a nightmare. It's a well documented design choice

Re: OAuth for all

#134

Post by rapind »

moduspol wrote: post #119
clickety_clack wrote: post #112

Earlier quoted context omitted.

For enterprise, the ability to shut out a user with one click is the overriding security feature. I don’t know why anyone wants to use a federated identity to sign into things. Where did the messaging that it’s more secure come from, Google?

Normal people just reuse a few variations of the same password across all of their accounts. Federated identity isn't bulletproof but it beats the heck out of reusing the same password.

Login tokens solves the re-use (but does put the onus on their email being secure).

Re: OAuth for all

#135

Post by rapind »

chrisan wrote: post #122
fsfasfd wrote: post #120

Earlier quoted context omitted.

Do you remember when people had to "remember" a password for every service they use? It is better to use a trusted third party. Sure these third parties are big corporations, but its safer for most people to have a login that just works, even at the cost of some privacy. People trying to remember passwords is a pretty bad security situation. I'm not an expert but so often folks on here throw criticisms without giving…

A password manager can both take care of remembering unique passwords and allow privacy options

Hard to convince users that they need to be using a password manager if you run a SaaS. Also when things like LastPASS getting hacked are on the front page... imagine advising people to use that one! (I'm guilty of recommending LastPASS many years ago, before their first breach).

Re: OAuth for all

#136

Post by deaton »

clickety_clack wrote: post #112
willtemperley wrote: post #18

Earlier quoted context omitted.

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

For enterprise, the ability to shut out a user with one click is the overriding security feature. I don’t know why anyone wants to use a federated identity to sign into things. Where did the messaging that it’s more secure come from, Google?

It probably is more secure, to be honest. I trust Google to keep my account secure more than I trust some random website to store password hashes and verify securely.

Re: OAuth for all

#137

Post by rapind »

vintermann wrote: post #28
willtemperley wrote: post #18

Earlier quoted context omitted.

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

Your OAuth provider can also vouch for anyone who pretends to be you, if they so desire. They can give access to anyone, including themselves.

Microsoft SSO does exactly this. They let you pretend to be someone else's email, making their SSO service pointless since you still need to do email verification anyways (at which point, just send a login token to sign them in, instead of using SSO).

Re: OAuth for all

#138

Post by luma »

willtemperley wrote: post #18
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

It also makes authentication Not Your Problem. Getting someone else to handle password resets alone seems worth the squeeze.

Re: OAuth for all

#140

Post by mwwaters »

rockskon wrote: post #132
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

OAuth 2.0 is a hate crime against security given its complexity.

When I really dove into it, I understood mostly why all the complexity was all there if I cared about data at the identity provider.

When it’s only used for SSO, it’s extreme overkill.

Post reply on HN