3 ms·
That is a very good question as are the answers given. I think the important take-away from all this is that OAuth and OpenId and what have you are very compli
by galaxyLogic 7y ago
That is a very good question as are the answers given.
I think the important take-away from all this is that OAuth and OpenId and what have you are very complicated.
That would seem to be the reason many companies can make a living out of providing them to you.
Now could it all be made easier and simpler to understand somehow? Don't know but that would be great.
- dwaite 7y agoThere are different sorts of hard bits IMHO. OAuth and OpenID Connect can be _conceptually_ hard; you are abstracting authentication and authorization into a protocol and therefore inheriting someone else's model. When that model is presented in the form of a spattering of specifications, understanding and mapping to that model can be really laborious . You also may be doing this as part of a new architecture on your side (e.g. moving from traditional server-side rendered web applications to PWA/SPA apps using APIs). Strong Authentication and Account Lifecycle Management actually are just a whole lot of logic. Authentication is also something which is continually evolving to stay ahead of attackers. They are hard from the perspective of amount of work required, the distraction from your actual product mission, and the consequence of getting them wrong.
- galaxyLogic 7y agoAnother thing that makes it hard I think is that these are all by necessity multi-agent protocols/algorithms. How should we unambiguously describe and specify them? Well verbal verbiage is not very formal. Maybe something like: https://en.wikipedia.org/wiki/Specification_and_Description_Language https://en.wikipedia.org/wiki/Specification_and_Description_... What makes this all rather critical is that these are security procedures and, and complexity is the foe of security.