Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth for all

blog.cloudflare.com

Post reply on HN
Print view View original

171–174 of 174 posts

Re: OAuth for all

#171

Post by swyx »

shimman wrote: post #126
swyx wrote: post #42

Earlier quoted context omitted.

i mean. fair trade?

No, consolidation within the tech industry has never been good for workers or open source development. For someone who considers themselves as part of the open source community I've been extremely disappointed how anti-worker and pro-corporation you come across. Don't worry you aren't unique in this regard, many other nonworking dev influencers say similar things: never championing for workers but somehow always cham…

i have insufficient energy to productively disagree but defend your right to be wrong

Re: OAuth for all

#172

Post by nemoniac »

Can anyone recommend a straightforward, open-source OAUTH solution to self-host.

Ideally I would like to be able to ask a user for their Google/Microsoft/Apple email address and just drop it into a config file for authorization. The user then autenticates themselves at their G/M/A Id server and gets access. Or is this too simplistic?

Re: OAuth for all

#174

Post by cad »

zigzag312 wrote: post #65
cad wrote: post #46

Earlier quoted context omitted.

Don't get me wrong but data shows that you will likely fail to keep that api key a as secret and you will also fail to revoke when it becomes necessary. You will definately not going to rotate it frequently as you should. Good thing about the OAuth2/OIDC is these things will not put the trust on the bearer of the api key, but on actual identity that needs to have the access.

Can you share source of this data? I have my doubts about the quality of the data, since OAuth2 is such a complex system with so many footguns. In the end there is always some long lived secret. What changes is just where and how it is stored, secured and used. I bet we can generalize to say that data shows that you will likely fail to properly secure any secret (including the ones used in OAuth2). EDIT: An example:…

https://www.gitguardian.com/files/the-state-of-secrets-spraw...

> In the 2025 report, we showed that nearly 70% of credentials confirmed as valid in 2022 were still valid as of January 2025, meaning they have not been rotated or otherwise remediated. When we retested the same dataset in January 2026, the validity rate remained over 64%. That persistence is not a rounding error. It is an operational signal that remediation, not detection, is still the industry’s limiting factor.

> In the end there is always some long lived secret. What changes is just where and how it is stored, secured and used.

Obviously. The point here is to reduce the number of them

Post reply on HN