4 ms·
That's exactly my impression too. Authentication is hard. And this isn't some random site wanting to store user data, they're doing invoice management! (So..
by ajross 4y ago
That's exactly my impression too. Authentication is hard. And this isn't some random site wanting to store user data, they're doing invoice management! (So... not quite handling money on behalf of users, but pretty darn close in terms of liability.)
Regardless of your feelings on Big Tech and Privacy and whatnot, this absolutely looks like a security downgrade to me. If I were someone looking for para-financial services like this to phish with fake users for fraud purposes, I'd probably start with a site like Slimvoice.
Personally I think there's a good argument to be made about the benefits and tradeoffs to allowing giant cloud companies to control the idea of "identity" on the internet. But if there's any market segment where big companies with deep pockets and extensive technical resources bring value, it's this one.
- catiopatio 4y ago> Authentication is hard. No, it’s not. It’s certainly not harder or more complicated than the OAuth protocol used support Google-based sign-in. Exactly what unique value do you believe these big companies bring, exactly?
- rattlesnakedave 4y agoIt actually is very hard. There’s a long tail of concerns that make it difficult to do authentication as well as a major player in the space.
- catiopatio 4y agoWhat exactly about it is hard?
- ajross 4y agoThe part where you guarantee to your users that the person you authenticated is who they seem to be. In this particular example: "Is this invoice I'm about to pay for the service I purchased, or is it fraud?" Farming that responsibility off to Google or Facebook and letting them handle the edge cases (for free, I might add) has genuine security value.