Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH with Facebook Auth

scaleft.com

Post reply on HN
Print view View original

1–10 of 18 posts

Re: SSH with Facebook Auth

#2

Post by bhhaskin »

Wouldn't this give Facebook indirect control over your server? If Facebook wanted to they could just ban your account. Or change your password. Also it is far more likely that a hacker is going to gain access to your Facebook account over well protected SSH.

Re: SSH with Facebook Auth

#3

Post by eatbitseveryday »

bhhaskin wrote: post #2

Wouldn't this give Facebook indirect control over your server? If Facebook wanted to they could just ban your account. Or change your password. Also it is far more likely that a hacker is going to gain access to your Facebook account over well protected SSH.

I think the idea is that you would use their service to specify the authentication method, and they would provide the ability to log in via that specification. They aren't forcing you to use FB; it is merely a demo of one of many authentication methods they'd be able to let you choose from:

> an experiment where you can share your servers with your friends by using Facebook as the authentication mechanism. It’s a quick way to show how versatile the ScaleFT authentication platform can be: Give us a reliable authentication mechanism, and we can log you into a server with it.

Re: SSH with Facebook Auth

#4

Post by bhhaskin »

eatbitseveryday wrote: post #3
bhhaskin wrote: post #2

Wouldn't this give Facebook indirect control over your server? If Facebook wanted to they could just ban your account. Or change your password. Also it is far more likely that a hacker is going to gain access to your Facebook account over well protected SSH.

I think the idea is that you would use their service to specify the authentication method, and they would provide the ability to log in via that specification. They aren't forcing you to use FB; it is merely a demo of one of many authentication methods they'd be able to let you choose from: > an experiment where you can share your servers with your friends by using Facebook as the authentication mechanism. It’s a qui…

Still. The idea that it is a service means that you are still handing over indirect control.

Re: SSH with Facebook Auth

#7

Post by nl »

bhhaskin wrote: post #2

Wouldn't this give Facebook indirect control over your server? If Facebook wanted to they could just ban your account. Or change your password. Also it is far more likely that a hacker is going to gain access to your Facebook account over well protected SSH.

In this specific case, yes. But this is a specific, fun, "try out a server" thing.

In "real life" you can setup SSH to fall back to other methods. See the howtos for setting up 2-Factor Auth[1] for example.

[1] https://www.digitalocean.com/community/tutorials/how-to-set-...

Re: SSH with Facebook Auth

#8

Post by russell_h »

bhhaskin wrote: post #4
eatbitseveryday wrote: post #3

Earlier quoted context omitted.

I think the idea is that you would use their service to specify the authentication method, and they would provide the ability to log in via that specification. They aren't forcing you to use FB; it is merely a demo of one of many authentication methods they'd be able to let you choose from: > an experiment where you can share your servers with your friends by using Facebook as the authentication mechanism. It’s a qui…

Still. The idea that it is a service means that you are still handing over indirect control.

Hey, one of the founders of ScaleFT here.

You're absolutely right that when you're using ScaleFT you're trusting both us (as operators of the CA) and your identity provider (in this case Facebook, but we have a bunch of other options more suitable for most businesses).

Handing over control isn't necessarily a bad thing. For example, I trust Google to operate a secure and reliable email service much more than I trust myself, leaving me to focus on my area of expertise. But trust is a complex thing and there are certainly situations where handing control to any third party is unacceptable.

For organizations that require complete control we can integrate with any SAML or OpenID Connect identity system, and we offer an on-premise version of ScaleFT.

Post reply on HN