4 ms·
If you'd bothered to read a little more before knee-jerking a reaction comment, you'd know this is only for the authentication flow.
by scrollaway 6y ago
If you'd bothered to read a little more before knee-jerking a reaction comment, you'd know this is only for the authentication flow.
- dleslie 6y agoI did read that; did you know that passing oauth tokens into such automation tools is commonplace?
- ath0 6y agoOAuth tokens used in automation tools will continue to work. Entering in username & password through auth, to automate an OAuth flow (or any other traditionally manual flow) will stop working. Breaks some puppeteer scripts too - but those have been getting flaky for a while now.
- dleslie 6y agoThus making it even more cumbersome for users; now they simply login, in the future they'll have to know how to get the oauth token.
- joshspankit 6y agoAnd, OAuth tokens can be revoked meaning scripts will just suddenly fail.
- scrollaway 6y agoWhat's your point? Passwords can change and sessions can get invalidated, which all has the same effect.
- joshspankit 6y agoYes I would agree with that, except that if you change a password you know the scripts will fail, but if an OAuth token gets invalidated by the system and not you, then it will fail without warning.
- scrollaway 6y agoAnd if your password gets reset by the system and not you, same story. What makes you say oauth tokens are any less robust? Aside from the fact they usually have an expiration attached to them, there's not much difference.
- joshspankit 6y agoAlso fair point. What makes me say that? Experience. However, I will say to counter my own point: it’s not all roses. Using password by necessity means that your password is now stored somewhere that is likely more easily compromised (In my case: secure passwords are stored in 1Password, but passwords for script usage are either stored in an ENV or in the script itself, neither of which are great from a security standpoint)
- detaro 6y agoIt's OAuth. The application can launch a normal browser for the OAuth flow and have the user complete it.
- bxk1 6y agoFor plenty of applications the whole purpose is not to run "a normal browser" and possibly not even have it installed.
- Dylan16807 6y agoThey can spit out a url for you to copy into a normal browser, then.
- detaro 6y agoYou can also use a browser on a different device if your thing can't run a browser itself. OAuth covers a large space of options.
- pjc50 6y agoAnd? What if I want to automate my login flow?
- izacus 6y agoYou'll need to find another provider which doesn't care that much about preventing phishing attacks. Google accounts are a big target so it makes sense you move away from the masses.
- pjc50 6y agoIn practice it just means faking the user-agent and other fingerprinting more enthusiastically. I'm not sure how google can win that without resorting to the same anti-cheat measures as games companies.
- jlokier 6y agoYou'll try, but the first time you won't know what fingerprinting tests they are going to do. After a few iterations you'll succeed, but it will be obvious to Google that the account you've just been testing it on belongs to someone trying to break their auth restrictions... Good luck keeping your account!
- deleted 6y ago[deleted]