Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OAuth for all

blog.cloudflare.com

Post reply on HN
Print view View original

91–100 of 174 posts

Re: OAuth for all

#91

Post by gchamonlive »

willtemperley wrote: post #18
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

Corporations aren't interested in preserving privacy, quite the opposite. If you need OAuth for private use you'd have to roll out your own centralised directory.

Re: OAuth for all

#92

Post by usernametaken29 »

aeneas_ory wrote: post #55
zaptheimpaler wrote: post #12

Oauth and enterprise auth has to be the worst thing ever made, it might be the most confusing and frustrating part of dealing with the cloud. Even the AI tools took a year to just get basic Oauth working on headless systems without assuming you could open a browser. If they're going to go down the auth rabbit hole with RBAC/IAM/Workload identities?/service accounts and all the trash the big cloud providers have, I ju…

OAuth2 is complex and often not the right tool. I wrote Ory Hydra and also a blog post when OAuth2 is/is not a good idea: https://www.ory.com/blog/oauth2-openid-connect-do-you-need-u... For API Keys we just launched Ory Talos ( https://github.com/ory/talos ) - a perfect alternative for when OAuth2 is too much for the use case. There are use cases and security concerns that legitimize using OAuth2 - with specs like DP…

Ory Hydra was one of the few tools I remember being actually good and lightweight and useable. Tried setting up and using KeyCloak for a while, absolute nightmare

Re: OAuth for all

#93

Post by hequmania »

v5v3 wrote: post #70

"Ory Enterprise License: Unlock enterprise-grade features like security SLAs for CVEs, SAML, B2B organizations, multi-tenancy, and better scalability." [0] Or just stick with KeyCloak that offers a full self hosted product... [1] [0] https://github.com/ory [1] https://www.keycloak.org/

[dead]

Re: OAuth for all

#95

Post by vachina »

utopiah wrote: post #53
swyx wrote: post #42

Earlier quoted context omitted.

i mean. fair trade?

It's a good move for them but it's problematic for anybody who cares about a decentralized Internet.

My policy has been, I make sure I have an equivalent self hosted solution that I can immediately switch to, before deploying said feature to Cloudflare.

That said I only use cloudflare for piping and none of the compute stuff.

Re: OAuth for all

#96

Post by hiimshort »

aeneas_ory wrote: post #51

Author of Ory Hydra here! Very cool to see this blog post and technical description! I never would have thought this piece of software would secure the internet companies in the world :) Also great to see that the 2.x version performs so well for you! The CPU use is ridiculously small for that scale! We have a commercial variant that‘s even faster, if you ever run into trouble. If anyone here is interested in providi…

Just a passerby, but wanted to say thanks for your work. Ory services are a delight and I was excited to see them spring up years ago and even more excited to see them continue to be developed and put to good use!

Re: OAuth for all

#97

Post by kentonv »

SCLeo wrote: post #78
breakingcups wrote: post #58

Earlier quoted context omitted.

Cloudflare is one of the most expensive providers out there once you step out of the basics. Look at their video streaming.

I cannot agree more. Cloudflare has some services that are really cheap (r2) to lure you into their worker "ecosystem", which is just serverless. Once you are vendor locked into their absolute garbage custom JavaScript runtime, you are pretty much forced to use their distributed database Cloudflare KV if you want good performance. Cloudflare KV is so extremely ridiculously absurdly expensive that make predatory prici…

Oh no... KV is not a distributed database and is really not intended as a database alternative at all. It's more meant for distributing bits of config globally. Cost aside, writes are way too slow for database-ish use and "eventually consistent" isn't what you want for state that is changing often. Durable Objects (SQLite) or Hyperdrive (edge caching in front of a normal postgres/mysql database) are what you want, and will probably be a lot cheaper. Sorry for the confusion.

Re: OAuth for all

#98

Post by r3trohack3r »

CommonGuy wrote: post #71

Cloudflare really likes to publish new projects, but improving them in the future is not really their style. Some examples: - They launched Cloudflare Web Analytics in 2020, but it still does not support basic things such as UTM parameters or custom events - With wrangler (their CLI), you still cannot undeploy a Cloudflare Page

The last commit to wrangler was 2 hours ago?

https://github.com/cloudflare/workers-sdk/tree/main/packages...

Re: OAuth for all

#99

Post by aeneas_ory »

hiimshort wrote: post #96
aeneas_ory wrote: post #51

Author of Ory Hydra here! Very cool to see this blog post and technical description! I never would have thought this piece of software would secure the internet companies in the world :) Also great to see that the 2.x version performs so well for you! The CPU use is ridiculously small for that scale! We have a commercial variant that‘s even faster, if you ever run into trouble. If anyone here is interested in providi…

Just a passerby, but wanted to say thanks for your work. Ory services are a delight and I was excited to see them spring up years ago and even more excited to see them continue to be developed and put to good use!

Truly appreciated, thank you :)

Re: OAuth for all

#100

Post by snorremd »

RealCodingOtaku wrote: post #85
willtemperley wrote: post #18

Earlier quoted context omitted.

What I don't understand is why OAuth is rarely talked about in a privacy context, however your OAuth provider knows all the sites you log into and when. It's a privacy nightmare.

Slight tangent. The only way to preserve privacy while having a central and easy authentication mechanism I can think of is to use IndieAuth[0] which is built on top of OAuth 2.0. Of course, you will need to be your own provider, using an IndieAuth provider service defeats the purpose, which is what I see most IndieWeb devs are doing. You will need to own a (sub)domain though. [0] https://indieweb.org/IndieAuth?redir…

WebFinger + self-hosted Oauth provider is indeed nice. Unfortunately not widely available.
Post reply on HN