5 ms·

happened to me a few months ago on github. Apparently "sign in with" lets the dev do whatever they like with your account. In reality, i simply signed in with

happened to me a few months ago on github. Apparently "sign in with" lets the dev do whatever they like with your account. In reality, i simply signed in with github because why not and suddenly everything is gone. A single email from github about "engaging in illegal behaviour of star farming so my account is deleted". I signed in to github, i just clicked a bunch of buttons simply out of form fatigue and in the background, the dev had used my account to star their repos. the problem is, why not punish the dev and why me? if the workflow was sign in, why did it allow my account to be used for stars farming? secondly, why to blame me? did i willingly engage in stars farming when i clicked on "sign in with" ? they said the same thing, "decision is final". I made a bunch of noise on HN and tomorrow everything was back in order for me. Learning outcome: dont use sign in with. ever

xigency 4y ago
Not sure why you’re getting downvoted. I certainly appreciate this heads-up.
- deleted 4y ago
  [deleted]
8organicbits 4y ago
Ref: https://news.ycombinator.com/item?id=33917962 https://news.ycombinator.com/item?id=33917962 That's horrible, I'm so sorry that happened to you. But I think that's the wrong learning outcome. As a technology, OAuth uses scopes to grant permissions. You mentioned that you didn't read the permissions before granting access. An app that requests zero scopes is still safe, as it can't star repos for you, but the burden falls on you to read. This is inherent to the design of OAuth. There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions. GitHub and others should be policing apps that request unreasonable permissions.
- paranoidrobot 4y ago
  > There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions. Auditing is only one problem. Why is granting permissions an all-or-nothing approach? Way too many apps are requesting all the permissions. If I want to use it, I've got zero choice. I want an 'Advanced' option with a way to deselect certain permissions.
  - JCharante 4y ago
    If they're requesting all the permissions then you shouldn't use them. If a random note taking app asks to read my contacts the first time I launch it then I'm going to assume it's malicious.
    - paranoidrobot 4y ago
      I meant more in general terms - apps are requesting more permissions than I want to grant them. I would like to see services allow users to limit the permissions actually granted. JIRA wants all the source code for your entire organisation. Tailscale wants to read all the organisations you're a member of. The problem is not just limited to Github. Grafana's Slack apps want to be able to read the entire Slack organisation, post messages as me, and a whole bunch of other things I'm just not comfortable giving it.
- infogulch 4y ago
  I think learning outcomes are simultaneously: 1. If you can't be bothered to read the terms, then don't use OAuth. This is GP's conclusion. 2. If you are willing and able to carefully read the scopes, and you are willing and able to abandon the app if the scopes are too broad, and you comprehend the meaning of the scopes, then use your discretion. But that's a lot of conditions, so... 3. All scopes should be revokable by the user, and potentially spoofable at their discretion. 4. The resolution of scopes should strike a balance between being understandable and following the principle of least privilege. 5. GitHub and other OAuth hosts (even all app platforms?) should audit apps for misbehavior, both in abuse of permissions and unnecessary permission requests. Especially when the user regrets the actions taken by the app.
- yellowapple 4y ago
  > But I think that's the wrong learning outcome. Unless and until GitHub fixes its combination of allowing overly-broad authentication/authorization scopes and victim-blaming over abuse of said scopes, the above is precisely the right learning outcome. At the very least, if GitHub supports programmatically adding 500 stars, then it should be downright trivial to support programmatically removing those 500 stars and giving the user a slap-on-the-wrist warning if the user really is the one at fault.
- Am4TIfIsER0ppos 4y ago
  > I think that's the wrong learning outcome It's the right outcome. Why would you tell microsoft anything besides your interactions with github.com
febusravenga 4y ago
And yet today, on top of HN we've got next app that requested GitHub login with scary "acting on your bahalf" whatever that means. There were some explanations, that they are sincere and they do only good thinks, but i retreated
deleted 4y ago
[deleted]
sofixa 4y ago
> did i willingly engage in stars farming when i clicked on "sign in with" ? Yes? You clicked accept to give access to an application to do stuff on your behalf. It is 100% your fault you didn't read what the very clear prompt said to you. That being said, the owner(s) of the application in question should be banned for their malicious practice of stars farming, and I don't see why you would be.
- deleted 4y ago
  [deleted]

xigency 4y ago

Not sure why you’re getting downvoted. I certainly appreciate this heads-up.

deleted 4y ago
[deleted]

8organicbits 4y ago

Ref: https://news.ycombinator.com/item?id=33917962 https://news.ycombinator.com/item?id=33917962 That's horrible, I'm so sorry that happened to you. But I think that's the wrong learning outcome. As a technology, OAuth uses scopes to grant permissions. You mentioned that you didn't read the permissions before granting access. An app that requests zero scopes is still safe, as it can't star repos for you, but the burden falls on you to read. This is inherent to the design of OAuth. There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions. GitHub and others should be policing apps that request unreasonable permissions.

paranoidrobot 4y ago
> There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions. Auditing is only one problem. Why is granting permissions an all-or-nothing approach? Way too many apps are requesting all the permissions. If I want to use it, I've got zero choice. I want an 'Advanced' option with a way to deselect certain permissions.
- JCharante 4y ago
  If they're requesting all the permissions then you shouldn't use them. If a random note taking app asks to read my contacts the first time I launch it then I'm going to assume it's malicious.
  - paranoidrobot 4y ago
    I meant more in general terms - apps are requesting more permissions than I want to grant them. I would like to see services allow users to limit the permissions actually granted. JIRA wants all the source code for your entire organisation. Tailscale wants to read all the organisations you're a member of. The problem is not just limited to Github. Grafana's Slack apps want to be able to read the entire Slack organisation, post messages as me, and a whole bunch of other things I'm just not comfortable giving it.
infogulch 4y ago
I think learning outcomes are simultaneously: 1. If you can't be bothered to read the terms, then don't use OAuth. This is GP's conclusion. 2. If you are willing and able to carefully read the scopes, and you are willing and able to abandon the app if the scopes are too broad, and you comprehend the meaning of the scopes, then use your discretion. But that's a lot of conditions, so... 3. All scopes should be revokable by the user, and potentially spoofable at their discretion. 4. The resolution of scopes should strike a balance between being understandable and following the principle of least privilege. 5. GitHub and other OAuth hosts (even all app platforms?) should audit apps for misbehavior, both in abuse of permissions and unnecessary permission requests. Especially when the user regrets the actions taken by the app.
yellowapple 4y ago
> But I think that's the wrong learning outcome. Unless and until GitHub fixes its combination of allowing overly-broad authentication/authorization scopes and victim-blaming over abuse of said scopes, the above is precisely the right learning outcome. At the very least, if GitHub supports programmatically adding 500 stars, then it should be downright trivial to support programmatically removing those 500 stars and giving the user a slap-on-the-wrist warning if the user really is the one at fault.
Am4TIfIsER0ppos 4y ago
> I think that's the wrong learning outcome It's the right outcome. Why would you tell microsoft anything besides your interactions with github.com

febusravenga 4y ago

And yet today, on top of HN we've got next app that requested GitHub login with scary "acting on your bahalf" whatever that means. There were some explanations, that they are sincere and they do only good thinks, but i retreated

deleted 4y ago

[deleted]

sofixa 4y ago

> did i willingly engage in stars farming when i clicked on "sign in with" ? Yes? You clicked accept to give access to an application to do stuff on your behalf. It is 100% your fault you didn't read what the very clear prompt said to you. That being said, the owner(s) of the application in question should be banned for their malicious practice of stars farming, and I don't see why you would be.

deleted 4y ago
[deleted]