4 ms·

The redeeming feature about OAUTH, like pretty much anything security related, is that if you don’t give people a standard to follow then you are probably going

The redeeming feature about OAUTH, like pretty much anything security related, is that if you don’t give people a standard to follow then you are probably going to end up with something that is insecure and poorly implemented. A lot of people just don’t have the background to do good security work, and when you try to explain why a short lived credential is good, or why we can’t have a plain text password embedded in the git repo, their eyes glaze over and you lose them. So it’s much easier to just dictate it will be a tls connection and you’ll use OAUTH, and then they go download a library and everything is good. Where I ran into problems is with using OAUTH for federated user logins. I did a proof of concept with Facebook, then after a couple hours they decided I was a robot and that was that - account closed, no recourse. Luckily that happened before I had a large user base using it - I don’t know what you do if Facebook decides your a robot and suddenly 50,000 people can’t authenticate to your site, guess you learn something. A week later most of the other sites decided I was a robot and terminated my accounts. Google is the only site that didn’t. (Which is good because I have a decade of e-mail and photos I’d hate to lose)

unclebucknasty 8y ago
>don’t know what you do if Facebook decides your a robot and suddenly 50,000 people can’t authenticate to your site This is exactly why I am paranoid about depending entirely on social sign up/in. So if the API provides it, I believe it's a good idea to capture the email address associated with the social account and either generate a hard password for later reset if necessary or request the user set one up. The latter obviously reduces a little convenience of the social sign up, but does hint to the user that they can sign-in otherwise and gives them control. Authentication is just too important to completely outsource without recourse.
- brokenwren 8y ago
  > Authentication is just too important to completely outsource without recourse I agree 100%. You need to own your users and all of their data. Along those same lines, I wouldn't want my user data going into a multi-tenant, cloud-hosted solution like Okta. I'd much prefer to store everything on my own servers or use an on-premise solution like FusionAuth or KeyCloak.
  - unclebucknasty 8y ago
    >...use an on-premise solution like FusionAuth or... https://news.ycombinator.com/user?id=brokenwren https://news.ycombinator.com/user?id=brokenwren I see what you did there. :) Good luck.
    - brokenwren 8y ago
      Haha. I try to be upfront that I work for FusionAuth. I mentioned it in my other comments in the thread but forgot to mention it here. Thanks for keeping me honest. ;)
Semaphor 8y ago
Not to mention your users ignoring your site because they don't think FB (or GitHub, or Google, or whoever) need to know about you logging in there. I refuse to use any site that doesn't let me create an account.

unclebucknasty 8y ago

>don’t know what you do if Facebook decides your a robot and suddenly 50,000 people can’t authenticate to your site This is exactly why I am paranoid about depending entirely on social sign up/in. So if the API provides it, I believe it's a good idea to capture the email address associated with the social account and either generate a hard password for later reset if necessary or request the user set one up. The latter obviously reduces a little convenience of the social sign up, but does hint to the user that they can sign-in otherwise and gives them control. Authentication is just too important to completely outsource without recourse.

brokenwren 8y ago
> Authentication is just too important to completely outsource without recourse I agree 100%. You need to own your users and all of their data. Along those same lines, I wouldn't want my user data going into a multi-tenant, cloud-hosted solution like Okta. I'd much prefer to store everything on my own servers or use an on-premise solution like FusionAuth or KeyCloak.
- unclebucknasty 8y ago
  >...use an on-premise solution like FusionAuth or... https://news.ycombinator.com/user?id=brokenwren https://news.ycombinator.com/user?id=brokenwren I see what you did there. :) Good luck.
  - brokenwren 8y ago
    Haha. I try to be upfront that I work for FusionAuth. I mentioned it in my other comments in the thread but forgot to mention it here. Thanks for keeping me honest. ;)

Semaphor 8y ago

Not to mention your users ignoring your site because they don't think FB (or GitHub, or Google, or whoever) need to know about you logging in there. I refuse to use any site that doesn't let me create an account.