5 ms·

> Social sign up focuses on delegating authentication to social websites So, don't ask for passwords, ask for another site so that it asks the user for the pas

> Social sign up focuses on delegating authentication to social websites So, don't ask for passwords, ask for another site so that it asks the user for the password.

nathanaldensr 8y ago
Not only that, but now that social site is aware of your relationship with the delegating party (in this case, eBay), which I hope at least some folks realize is not in their best interests.
scrollaway 8y ago
What's the problem with that though? Delegating authentication feels like such an obvious thing: You allow a certain party to manage your identity, and trust them with it. You don't want to trust every random website to implement proper password storage, add 2fa support, yubikey, security notifications, etc etc. I have a problem with how OAuth2, when used for authentication, locks users into a certain provider. Wish there was a solution to that. But delegating authentication really should be taken more seriously. (A good example actually is... ebay, the very author of this article, that despite managing entire businesses and moving tons of money around, doesn't have proper MFA, has really dumb password limitations, etc. I certainly wish ebay would let me log in with Google...)
- JumpCrisscross 8y ago
  > What's the problem with that though? You don’t just delegate authentication. I trust Facebook to authenticate me. That doesn’t mean I trust them with my entire web presence. Delegating authentication promotes centralisation, which is presently to be a greater systemic risk to the Internet than some kitty picture site getting hacked.
  - scrollaway 8y ago
    Which is why it's important to have alternatives, yes. You don't want to have to only trust Facebook, you want to have it as a choice. The OpenID "dream": Users choose between different authentication services based on their needs. I like Google auth because I pay for Google. I trust them because they're a lot better at security than statistically almost every other service on the web. I would trust Facebook, but I don't want them to know about my web presence as you pointed out. And to keep those services in check, you have to have alternatives. The Payment request API is a good example of what we should be seeing for authentication. Secure delegation without lockin.
    - JumpCrisscross 8y ago
      > Users choose between different authentication services based on their needs Network effects inherently promote centralization. Third-party authentication exhibits network effects. Furthermore, given nobody pays for this service, we not only have a bias towards centralization but also incumbency. Individually weak but diversified is a more robust model than strong but centralized. That was the fundamental insight of capitalism and of the Internet. Third party authentication promotes the latter.
- ryandrake 8y ago
  I’m totally fine with delegating authentication, but only to some entity I trust. (Hint: that’s not going to be Facebook or any other big company) If you are going to require me to have a Facebook account in order to be your customer, then I’m not going to be your customer. Or, better yet, let me delegate to my own service. That was one of the great promises of OpenID: you can run your own identity provider and delegate authentication to that. Too few sites support OpenID as a relying party.
- marssaxman 8y ago
  Why would I trust some other party to manage my identity?
  - scrollaway 8y ago
    > Why would I trust some other party to manage my [money]? You don't trust some other party, you trust the one you choose. And if you don't trust any, you can manage it yourself. Authentication should work like banks. Now we're not quite there yet, the site owners choose for you. That's a big shame, but it's still better than trusting some actual random website to manage your authentication.
- woliveirajr 8y ago
  I wasn't even considering if it is good or bad. My point was just about the password: if the new model is passwordless, well, making me (an user) type some password in the own site, or in an app, or in the facebook site, well... It has passwords. Perhaps good for the IT of ebay if they can say to someone that now they don't have to worry about passwords. I will still type some password, somewhere.
  - scrollaway 8y ago
    How you authenticate with that third party is between you and that third party. It just so happens that passwords are extremely common, but the third party might be a passwordless site as well. The point is to delegate to someone that does authentication better than you.
- 0xfaded 8y ago
  Depends whether or not you consider Facebook to be a "random website" or not.
paulpauper 8y ago
it's passwords all the way down.

> Social sign up focuses on delegating authentication to social websites So, don't ask for passwords, ask for another site so that it asks the user for the password.

nathanaldensr 8y ago

Not only that, but now that social site is aware of your relationship with the delegating party (in this case, eBay), which I hope at least some folks realize is not in their best interests.

scrollaway 8y ago

What's the problem with that though? Delegating authentication feels like such an obvious thing: You allow a certain party to manage your identity, and trust them with it. You don't want to trust every random website to implement proper password storage, add 2fa support, yubikey, security notifications, etc etc. I have a problem with how OAuth2, when used for authentication, locks users into a certain provider. Wish there was a solution to that. But delegating authentication really should be taken more seriously. (A good example actually is... ebay, the very author of this article, that despite managing entire businesses and moving tons of money around, doesn't have proper MFA, has really dumb password limitations, etc. I certainly wish ebay would let me log in with Google...)

JumpCrisscross 8y ago
> What's the problem with that though? You don’t just delegate authentication. I trust Facebook to authenticate me. That doesn’t mean I trust them with my entire web presence. Delegating authentication promotes centralisation, which is presently to be a greater systemic risk to the Internet than some kitty picture site getting hacked.
- scrollaway 8y ago
  Which is why it's important to have alternatives, yes. You don't want to have to only trust Facebook, you want to have it as a choice. The OpenID "dream": Users choose between different authentication services based on their needs. I like Google auth because I pay for Google. I trust them because they're a lot better at security than statistically almost every other service on the web. I would trust Facebook, but I don't want them to know about my web presence as you pointed out. And to keep those services in check, you have to have alternatives. The Payment request API is a good example of what we should be seeing for authentication. Secure delegation without lockin.
  - JumpCrisscross 8y ago
    > Users choose between different authentication services based on their needs Network effects inherently promote centralization. Third-party authentication exhibits network effects. Furthermore, given nobody pays for this service, we not only have a bias towards centralization but also incumbency. Individually weak but diversified is a more robust model than strong but centralized. That was the fundamental insight of capitalism and of the Internet. Third party authentication promotes the latter.
ryandrake 8y ago
I’m totally fine with delegating authentication, but only to some entity I trust. (Hint: that’s not going to be Facebook or any other big company) If you are going to require me to have a Facebook account in order to be your customer, then I’m not going to be your customer. Or, better yet, let me delegate to my own service. That was one of the great promises of OpenID: you can run your own identity provider and delegate authentication to that. Too few sites support OpenID as a relying party.
marssaxman 8y ago
Why would I trust some other party to manage my identity?
- scrollaway 8y ago
  > Why would I trust some other party to manage my [money]? You don't trust some other party, you trust the one you choose. And if you don't trust any, you can manage it yourself. Authentication should work like banks. Now we're not quite there yet, the site owners choose for you. That's a big shame, but it's still better than trusting some actual random website to manage your authentication.
woliveirajr 8y ago
I wasn't even considering if it is good or bad. My point was just about the password: if the new model is passwordless, well, making me (an user) type some password in the own site, or in an app, or in the facebook site, well... It has passwords. Perhaps good for the IT of ebay if they can say to someone that now they don't have to worry about passwords. I will still type some password, somewhere.
- scrollaway 8y ago
  How you authenticate with that third party is between you and that third party. It just so happens that passwords are extremely common, but the third party might be a passwordless site as well. The point is to delegate to someone that does authentication better than you.
0xfaded 8y ago
Depends whether or not you consider Facebook to be a "random website" or not.

paulpauper 8y ago

it's passwords all the way down.