3 ms·
From a privacy perspective, OAuth/OIDC are also terrible. It would be possible to achieve the same thing in a privacy-preserving way, and without breaking curr
by jedisct1 6y ago
From a privacy perspective, OAuth/OIDC are also terrible.
It would be possible to achieve the same thing in a privacy-preserving way, and without breaking current deployments; EL PASSO https://arxiv.org/pdf/2002.10289.pdf https://arxiv.org/pdf/2002.10289.pdf is an example of it.
But looks like there is no (commercial?) interest in improving user’s privacy.
- will4274 6y agoAs it turns out, privacy preserving federated auth is actually typically bad for most users - as then the federated auth provider can't identify or ban malicious apps.
- ForHackernews 6y agoThe OAuth2 spec requires only a totally opaque "access token". There's nothing about the protocol that makes it bad for privacy. On the other hand, the implementations offered by Google, etc..