3 ms·

I actually prefer it if people use OpenID providers like Google vs rolling their own account management and authentication.

• Aachen 4y ago
  But you still need to roll your own authentication, the only thing you outsource is the actual page where you enter the password or click on forgot password. Your application doesn't magically know that jupp0r shouldn't have access to my documents or isn't an administrator or something, you still need to build each of those boundaries, and now it's more complicated because it can be from any number of third parties. (I audit stuff like this for a living; not once has an external login page helped, and it's significantly harder to audit because you have extra complexity going on with signatures and scopes instead of a regular hash check in a table, not to mention never being allowed to test said third party.) Not so long ago the general opinion was that this centralization to google/facebook logins wasn't a good thing. I wonder if it's just you or if the general opinion is going in the direction of convenience for the 99% rather than prioritizing security, privacy, and availability...
  • jupp0r 4y ago
    You need to roll your own authorization, authentication is provided by the third party provider. Of course you need to check and verify that users authenticated correctly against the third party provider. I don’t have to tell you this as you do this for a living, but saving having to implement half of the oauth flow is a good thing, right?