5 ms·

I find auth stuff to be a huge ball of frustration for everybody. It strikes me as if the people designing auth mechanisms and APIs and people designing usable

I find auth stuff to be a huge ball of frustration for everybody. It strikes me as if the people designing auth mechanisms and APIs and people designing usable UX are different species with different goals and value systems, and this leaks out all the way up to the user. In many ways this is just growing pains. For years people willingly handed their name/password to third party apps and sites, and this granted those sites full auth. This was too permissive, but extremely easy for people to understand, even for non-techies. With things like OAuth, OS level capabilities in iOS and Android, etc., we've now got to break down these "scopes" into slices that are flexible enough to write useful software against without being too broad, too revealing of the underling software architecture (brittle), and too confusing for the user. I think this is actually a really hard problem.

hpoe 6y ago
Having worked as an Auth engineer for 5 years I can reaffirm not just does auth suck everyone doing auth in any capacity sucks. The analogy that I like to use that illustrates the problem is that Auth is like working with the DMV. No one wants to do it, everyone wants to get it over with as quickly as possible, it has a vast complicated structure that people don't want to know about or need to know about, it is usually painful, it doesn't actually give you any benefit but you have to do it anyway no matter who you are. Thus everyone is trying to hammer out the minimum they can to pass the minimum requirements and then try to forget it exists at all.
- frenchy 6y ago
  Also, if you just ditch the whole enterprise, you end up with even worse problems.
wvh 6y ago
I've been doing some auth development. Auth is hard because it's a deeply human problem, and therefore messy. Human beings share, cooperate cross-boundaries, self-organise and divide in all sorts of groups and hierarchies. There are policies and rules, and then there are unwritten rules and exceptions. On top of that, the planning phase of projects has lots of graphs and arrows of what needs to go where, but rarely includes the auth boundaries and permissions. It's an ungrateful job because basically you're throwing hurdles and setting limitations where everything would work by default in the utopia of an open internet (or intranet).

hpoe 6y ago

Having worked as an Auth engineer for 5 years I can reaffirm not just does auth suck everyone doing auth in any capacity sucks. The analogy that I like to use that illustrates the problem is that Auth is like working with the DMV. No one wants to do it, everyone wants to get it over with as quickly as possible, it has a vast complicated structure that people don't want to know about or need to know about, it is usually painful, it doesn't actually give you any benefit but you have to do it anyway no matter who you are. Thus everyone is trying to hammer out the minimum they can to pass the minimum requirements and then try to forget it exists at all.

frenchy 6y ago
Also, if you just ditch the whole enterprise, you end up with even worse problems.

wvh 6y ago

I've been doing some auth development. Auth is hard because it's a deeply human problem, and therefore messy. Human beings share, cooperate cross-boundaries, self-organise and divide in all sorts of groups and hierarchies. There are policies and rules, and then there are unwritten rules and exceptions. On top of that, the planning phase of projects has lots of graphs and arrows of what needs to go where, but rarely includes the auth boundaries and permissions. It's an ungrateful job because basically you're throwing hurdles and setting limitations where everything would work by default in the utopia of an open internet (or intranet).