4 ms·

So, this doesn't look like they've actually broken any new ground here that you can't achieve with existing commercial products like Okta or Auth0. They're taki

by tootie 6y ago

So, this doesn't look like they've actually broken any new ground here that you can't achieve with existing commercial products like Okta or Auth0. They're taking an extra step of asking you to store hashes of their hashes. Which actually feels less secure since if hackers get their hashes, that as good as getting clear passwords to login directly your site? I'm not actually clear on that. But either way, the diagram says they're hashing phone numbers, so presumably that means they authenticate by typing in their phone number which is a terribly password since you give you phone number out to people so they must also send a TOTP via SMS which is better, but not great. NIST has started recommending not to use SMS for out-of-band authentication. Either way, this whole chain of events just delegates authentication your mobile carrier. Same thing if you send a TOTP to an email address. It feels more seamless, but really you're just delegating auth to their email provider. No different that using OAuth.

fapi1974 6y ago
This is solid advice - thanks. One of the things they mentioned is that this would help prevent botnets. Would OAuth also do that? Also - does the opensource, non-profit status change the dynamics?
- gmfawcett 6y ago
  Not sure why either open-source or non-profit would change the dynamics? Non-profits are still incentive-driven, and their goals may not align with yours; and open-source code is entirely independent of how data is collected, shared, etc. People do evil with OSS all the time. :)
- Kalium 6y ago
  No, nothing about being open-source or a non-profit fixes the technical flaws in a system's design choices. It just makes this a poor design with an ethically pleasing organization behind it.
Kalium 6y ago
> Which actually feels less secure since if hackers get their hashes, that as good as getting clear passwords to login directly your site? I'm not actually clear on that. You're right. This turns hashes into passwords, and is distinctly a step down in security.

by tootie 6y ago

fapi1974 6y ago

This is solid advice - thanks. One of the things they mentioned is that this would help prevent botnets. Would OAuth also do that? Also - does the opensource, non-profit status change the dynamics?

gmfawcett 6y ago
Not sure why either open-source or non-profit would change the dynamics? Non-profits are still incentive-driven, and their goals may not align with yours; and open-source code is entirely independent of how data is collected, shared, etc. People do evil with OSS all the time. :)
Kalium 6y ago
No, nothing about being open-source or a non-profit fixes the technical flaws in a system's design choices. It just makes this a poor design with an ethically pleasing organization behind it.

Kalium 6y ago

> Which actually feels less secure since if hackers get their hashes, that as good as getting clear passwords to login directly your site? I'm not actually clear on that. You're right. This turns hashes into passwords, and is distinctly a step down in security.