5 ms·

> I'm OK with requiring OAuth. It's hard to trust third parties with data they collect themselves: see Sony and Gawker. It's even harder to trust them with data

by zedshaw 15y ago

> I'm OK with requiring OAuth. It's hard to trust third parties with data they collect themselves: see Sony and Gawker. It's even harder to trust them with data that belongs to someone else: they might one-way-hash their own passwords, of course, but they can't do that to your Twitter password. It's probably sitting in a database, cleartext, for every rogue employee or cracker to see. That's a load of FUD crap the OAuth and OpenID projects perpetuate. If you can't trust the 3rd party then why the hell are you logging in? If it's a matter of "they might get hacked" then why is Twitter suddenly special and is somehow magically more safe? Trust me, based on what I hear Twitter is not more safe than Gawker. How is a more complicated login system safer? More complicated things like OAuth are not safer, they're just more complicated. The entire security premise of OAuth is junk. It's only advantage is that Twitter/Facebook/Google become the owners of your users and can leverage that against you or the other site. It's just idiotic to say that the only way to secure your access to SuperHackable.com is to go through Twitter.com as if that makes SuperHackable.com better or that Twitter.com has some sort of magic super powers.

jrockway 15y ago
If you can't trust the 3rd party then why the hell are you logging in? Well, you can't really trust any third parties. So, to minimize exposure, you want to trust as few of them as possible. Now, obviously the Sony incident shows us how trusting big companies is not a good idea, but in general, bigger companies are going to try harder to protect your data because they have more to lose. Your weekend project has nothing to lose if it starts spamming my Twitter followers. But I really didn't mean to bring up this particular topic; I apologize. I'm discussing OAuth in the context of allowing applications to do stuff to your Twitter account, not to authenticate you as you. So Twitter isn't owning your users, you are merely allowing users to delegate their Twitter permissions to you on a fine-grained basis. This is nice because it allows, say, an app to read my public tweets, but not to send them. Giving an app my password means it can do anything, and all I can do is change my password (killing all legitimate apps, too) if it does Something Bad. I think we can agree that that's sub-optimal. I personally will not use apps that require me to use a third party to create an account. I don't mind running my own OpenID server, though, or delegating it if I'm feeling lazy. I do mind being locked into someone else's platform forever.
pilif 15y ago
Twitter can store a (bcrypt hopefully) hash of my password. The third party must story my password in plain text (yes. it could store it encrypted, but it must be able to decrypt it, so an attacker could too).
MatthewPhillips 15y ago
Now I really want to buy superhackable.com... it's available.

by zedshaw 15y ago

jrockway 15y ago

If you can't trust the 3rd party then why the hell are you logging in? Well, you can't really trust any third parties. So, to minimize exposure, you want to trust as few of them as possible. Now, obviously the Sony incident shows us how trusting big companies is not a good idea, but in general, bigger companies are going to try harder to protect your data because they have more to lose. Your weekend project has nothing to lose if it starts spamming my Twitter followers. But I really didn't mean to bring up this particular topic; I apologize. I'm discussing OAuth in the context of allowing applications to do stuff to your Twitter account, not to authenticate you as you. So Twitter isn't owning your users, you are merely allowing users to delegate their Twitter permissions to you on a fine-grained basis. This is nice because it allows, say, an app to read my public tweets, but not to send them. Giving an app my password means it can do anything, and all I can do is change my password (killing all legitimate apps, too) if it does Something Bad. I think we can agree that that's sub-optimal. I personally will not use apps that require me to use a third party to create an account. I don't mind running my own OpenID server, though, or delegating it if I'm feeling lazy. I do mind being locked into someone else's platform forever.

pilif 15y ago

Twitter can store a (bcrypt hopefully) hash of my password. The third party must story my password in plain text (yes. it could store it encrypted, but it must be able to decrypt it, so an attacker could too).

MatthewPhillips 15y ago

Now I really want to buy superhackable.com... it's available.