4 ms·

I believe that the safest way is not to save them. Instead, outsource this to a few select OAuth providers which you and your customers are willing to trust.

sarciszewski 11y ago
What do you do if your name is Dread Pirate Rogers and the set of OAuth providers you and your customers trust is "None"?
- dogweather 11y ago
  Heh, good point.
jsmeaton 11y ago
I agree for the majority of cases. There still exist classes of applications where you can't rely on personal accounts on social sites for auth. Anything that runs behind your firewall for instance. In my particular case, we run some "enterprise software" on behalf of our customers, whose users regularly don't even have a work email address. Our customers are certainly not going to want users to use their own personal addresses. Most of this can be solved with SAML, but it requires all of these old enterprisey stacks to convert their auth systems to be SAML compatible. In the long term though, I think SAML and OAuth will be more prevalent than using passwords everywhere. Are there any OAuth providers established that simply provide email addresses? I feel there's definitely room for a company to setup an OAuth provider that doesn't do anything except provide identity, rather than relying on personal information harvester companies (FB, Google, etc). The hard part would be getting onto the approved OAuth providers list of all the sites that users want access to.
CM30 11y ago
What do you do about sites where the users don't particularly likely said providers? Not everyone uses Facebook or Google or Twitter after all, and a lot more would rather use an anonymous disposable account than one tied to an existing identity. There's also the fact said systems seem to be a nice target for spammers. They're popular, so they're often attacked. And because they're often attacked, their anti spam defences don't usually last very long. So any spammer now has a nice way to get an account on near enough any site they like, while with a standalone system, they'd at least have to tailor their attacks to the site in question. There's also the fact it silos much of the internet (or at least user information) within the systems of a few large providers, which gives a significant amount of control to said providers.
- dogweather 11y ago
  > Not everyone uses Facebook or Google or Twitter after all Yep, I do tailor the selection of oauth providers to my audience. E.g., an app for devs = google, github, and gitlab.

sarciszewski 11y ago

What do you do if your name is Dread Pirate Rogers and the set of OAuth providers you and your customers trust is "None"?

dogweather 11y ago
Heh, good point.

jsmeaton 11y ago

I agree for the majority of cases. There still exist classes of applications where you can't rely on personal accounts on social sites for auth. Anything that runs behind your firewall for instance. In my particular case, we run some "enterprise software" on behalf of our customers, whose users regularly don't even have a work email address. Our customers are certainly not going to want users to use their own personal addresses. Most of this can be solved with SAML, but it requires all of these old enterprisey stacks to convert their auth systems to be SAML compatible. In the long term though, I think SAML and OAuth will be more prevalent than using passwords everywhere. Are there any OAuth providers established that simply provide email addresses? I feel there's definitely room for a company to setup an OAuth provider that doesn't do anything except provide identity, rather than relying on personal information harvester companies (FB, Google, etc). The hard part would be getting onto the approved OAuth providers list of all the sites that users want access to.

CM30 11y ago

What do you do about sites where the users don't particularly likely said providers? Not everyone uses Facebook or Google or Twitter after all, and a lot more would rather use an anonymous disposable account than one tied to an existing identity. There's also the fact said systems seem to be a nice target for spammers. They're popular, so they're often attacked. And because they're often attacked, their anti spam defences don't usually last very long. So any spammer now has a nice way to get an account on near enough any site they like, while with a standalone system, they'd at least have to tailor their attacks to the site in question. There's also the fact it silos much of the internet (or at least user information) within the systems of a few large providers, which gives a significant amount of control to said providers.

dogweather 11y ago
> Not everyone uses Facebook or Google or Twitter after all Yep, I do tailor the selection of oauth providers to my audience. E.g., an app for devs = google, github, and gitlab.