51–60 of 134 posts
Hilarious.
Look, security UI is hard. Like, stumps experts hard. Like, they've been working at it for decades, trying to educate the population, hard.
I appreciate the will and the effort (as someone looking for their goldilocks OIDC proxy,) but this claim is a bit strong.
> By forcing the user to decide whether they trust the actual domain where the ID token will be sent, and not displaying any sort of logo which can be faked, security is improved. Hilarious. Look, security UI is hard . Like, stumps experts hard . Like, they've been working at it for decades, trying to educate the population, hard . I appreciate the will and the effort (as someone looking for their goldilocks OIDC pro…
Using email magic links as authentication mechanism is not a great choice in my opinion as email is not a very secure protocol if you think about the default smtp security guarantees and man-in-the-middle interception, either on the smtp or on the network level if servers communicate unencrypted.
If you believe email to be the weakest link in the chain, then you have to get rid of email password resets too and use reset codes instead. Lose your codes, lose your account.
Using email magic links as authentication mechanism is not a great choice in my opinion as email is not a very secure protocol if you think about the default smtp security guarantees and man-in-the-middle interception, either on the smtp or on the network level if servers communicate unencrypted.
If you believe email to be the weakest link in the chain, then you have to get rid of email password resets too and use reset codes instead. Lose your codes, lose your account.
> By forcing the user to decide whether they trust the actual domain where the ID token will be sent, and not displaying any sort of logo which can be faked, security is improved. Hilarious. Look, security UI is hard . Like, stumps experts hard . Like, they've been working at it for decades, trying to educate the population, hard . I appreciate the will and the effort (as someone looking for their goldilocks OIDC pro…
Using email magic links as authentication mechanism is not a great choice in my opinion as email is not a very secure protocol if you think about the default smtp security guarantees and man-in-the-middle interception, either on the smtp or on the network level if servers communicate unencrypted.
If you believe email to be the weakest link in the chain, then you have to get rid of email password resets too and use reset codes instead. Lose your codes, lose your account.
Ohh, looks extremely promising, I've been after something with a bit more flexibility than Dex while not being Keycloak/Java etc, an LDAP backend would be awesome as well though (another thing thats lacking is a simple ldap server, perhaps with sql as db, openldap is excessive and glauth isn't there)
Earlier quoted context omitted.
If you believe email to be the weakest link in the chain, then you have to get rid of email password resets too and use reset codes instead. Lose your codes, lose your account.
This. As sad as it is, email is the defacto identity on the internet. Every system I'm aware of falls back on email and/or phone numbers for recovery.
* there are a huge number of middlemen in emailing that you have to trust. the sending email provider, the receiving email provider, ISP, email client, the device the client resides on. and everyone else in between. * unless you're just hosting an email server on your local network, starting up an email server that can successfully get its messages across the internet to your intended recipient is an extremely high barrier.
email is an extremely error-prone protocol. there's lots of reasons that government/health organizations don't send you personal private information by email and instead send you an email that says to come log into their secure platform to view the private information.
Ohh, looks extremely promising, I've been after something with a bit more flexibility than Dex while not being Keycloak/Java etc, an LDAP backend would be awesome as well though (another thing thats lacking is a simple ldap server, perhaps with sql as db, openldap is excessive and glauth isn't there)
What's wrong with glauth? I forked it so I could build in the /etc/passwd support and it's been working great.
Earlier quoted context omitted.
This. As sad as it is, email is the defacto identity on the internet. Every system I'm aware of falls back on email and/or phone numbers for recovery.
just because email is often the defacto identity on the internet doesn't make it a good idea (bandwagon fallacy). i don't consider email tokens to be a serious form of authentication. unless you send the user their authentication secret with data encrypted by the user's public key, i strongly recommend against any use of email-based authentication. * there are a huge number of middlemen in emailing that you have to t…