3 ms·

Ref: https://news.ycombinator.com/item?id=33917962 https://news.ycombinator.com/item?id=33917962 That's horrible, I'm so sorry that happened to you. But I thin

Ref: https://news.ycombinator.com/item?id=33917962 https://news.ycombinator.com/item?id=33917962 That's horrible, I'm so sorry that happened to you. But I think that's the wrong learning outcome. As a technology, OAuth uses scopes to grant permissions. You mentioned that you didn't read the permissions before granting access. An app that requests zero scopes is still safe, as it can't star repos for you, but the burden falls on you to read. This is inherent to the design of OAuth. There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions. GitHub and others should be policing apps that request unreasonable permissions.

paranoidrobot 4y ago
> There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions. Auditing is only one problem. Why is granting permissions an all-or-nothing approach? Way too many apps are requesting all the permissions. If I want to use it, I've got zero choice. I want an 'Advanced' option with a way to deselect certain permissions.
- JCharante 4y ago
  If they're requesting all the permissions then you shouldn't use them. If a random note taking app asks to read my contacts the first time I launch it then I'm going to assume it's malicious.
  - paranoidrobot 4y ago
    I meant more in general terms - apps are requesting more permissions than I want to grant them. I would like to see services allow users to limit the permissions actually granted. JIRA wants all the source code for your entire organisation. Tailscale wants to read all the organisations you're a member of. The problem is not just limited to Github. Grafana's Slack apps want to be able to read the entire Slack organisation, post messages as me, and a whole bunch of other things I'm just not comfortable giving it.
infogulch 4y ago
I think learning outcomes are simultaneously: 1. If you can't be bothered to read the terms, then don't use OAuth. This is GP's conclusion. 2. If you are willing and able to carefully read the scopes, and you are willing and able to abandon the app if the scopes are too broad, and you comprehend the meaning of the scopes, then use your discretion. But that's a lot of conditions, so... 3. All scopes should be revokable by the user, and potentially spoofable at their discretion. 4. The resolution of scopes should strike a balance between being understandable and following the principle of least privilege. 5. GitHub and other OAuth hosts (even all app platforms?) should audit apps for misbehavior, both in abuse of permissions and unnecessary permission requests. Especially when the user regrets the actions taken by the app.
yellowapple 4y ago
> But I think that's the wrong learning outcome. Unless and until GitHub fixes its combination of allowing overly-broad authentication/authorization scopes and victim-blaming over abuse of said scopes, the above is precisely the right learning outcome. At the very least, if GitHub supports programmatically adding 500 stars, then it should be downright trivial to support programmatically removing those 500 stars and giving the user a slap-on-the-wrist warning if the user really is the one at fault.
Am4TIfIsER0ppos 4y ago
> I think that's the wrong learning outcome It's the right outcome. Why would you tell microsoft anything besides your interactions with github.com

paranoidrobot 4y ago

> There is a problem with GitHub scopes being overly broad, and users can't audit what an app actually does with those permissions. Auditing is only one problem. Why is granting permissions an all-or-nothing approach? Way too many apps are requesting all the permissions. If I want to use it, I've got zero choice. I want an 'Advanced' option with a way to deselect certain permissions.

JCharante 4y ago
If they're requesting all the permissions then you shouldn't use them. If a random note taking app asks to read my contacts the first time I launch it then I'm going to assume it's malicious.
- paranoidrobot 4y ago
  I meant more in general terms - apps are requesting more permissions than I want to grant them. I would like to see services allow users to limit the permissions actually granted. JIRA wants all the source code for your entire organisation. Tailscale wants to read all the organisations you're a member of. The problem is not just limited to Github. Grafana's Slack apps want to be able to read the entire Slack organisation, post messages as me, and a whole bunch of other things I'm just not comfortable giving it.

infogulch 4y ago

I think learning outcomes are simultaneously: 1. If you can't be bothered to read the terms, then don't use OAuth. This is GP's conclusion. 2. If you are willing and able to carefully read the scopes, and you are willing and able to abandon the app if the scopes are too broad, and you comprehend the meaning of the scopes, then use your discretion. But that's a lot of conditions, so... 3. All scopes should be revokable by the user, and potentially spoofable at their discretion. 4. The resolution of scopes should strike a balance between being understandable and following the principle of least privilege. 5. GitHub and other OAuth hosts (even all app platforms?) should audit apps for misbehavior, both in abuse of permissions and unnecessary permission requests. Especially when the user regrets the actions taken by the app.

yellowapple 4y ago

> But I think that's the wrong learning outcome. Unless and until GitHub fixes its combination of allowing overly-broad authentication/authorization scopes and victim-blaming over abuse of said scopes, the above is precisely the right learning outcome. At the very least, if GitHub supports programmatically adding 500 stars, then it should be downright trivial to support programmatically removing those 500 stars and giving the user a slap-on-the-wrist warning if the user really is the one at fault.

Am4TIfIsER0ppos 4y ago

> I think that's the wrong learning outcome It's the right outcome. Why would you tell microsoft anything besides your interactions with github.com