2 ms·
no i did not because when i click on “sign in with GitHub” flow, that is the only thing i expect to happen. whatever the dev added to the workflow is what i ass
by 2Gkashmiri 4y ago
no i did not because when i click on “sign in with GitHub” flow, that is the only thing i expect to happen. whatever the dev added to the workflow is what i assumed to be needed for the login to happen
- Aeolun 4y agoThat’s kinda your own fault. You could have known they were going to be able to star repos on your behalf if you’d read carefully. What is strange is that you are banned for an action someone else took. That doesn’t make any sense.
- yashap 4y agoAs I said, it’s a lesson to read more carefully. If you’re granting a sketchy website broad access to your accounts without even reading what you’re granting, bad things are guaranteed to happen. Also, seems like you’re probably a developer? If so, SSO, OAuth2, OIDC, etc. are worth learning about. You seem to be confusing/conflating SSO and OAuth2 authorization code flows, when they’re reasonably different things.
- netheril96 4y agoGitHub could not control what lies other websites tell. They can have a button saying “Sign in with GitHub”but totally not signing in with GitHub. That said GitHub should have banned that website for lying and abusing instead of OP.
- easyorgmode 4y agoThis proves the point that these third party "Sign in with" buttons are really dangerous. It makes a possibly dodgy website look more secure and legit by using a well known provider like Github for the login process. In addition, it potentially exposes data from that well known provider, which is often sensitive data, as in the case of Github.
- vel0city 4y agoWhen I double click on free_cookies.exe which I got from totallyawesomenotavirus.com I expect my computer to start giving me chocolate chip cookies. Or maybe I shouldn't just take everything at face value and pay attention to what I'm doing.
- scarface74 4y agoAnd how has that worked out for the last 40 years.