2 ms·
Well, the alternatives you mention are all prone to keyloggers or similar. If you take say OAuth/OIDC, the only thing the browser needs is the token. It doesn'
by magicalhippo 3y ago
Well, the alternatives you mention are all prone to keyloggers or similar.
If you take say OAuth/OIDC, the only thing the browser needs is the token. It doesn't have to be involved in the authentication at all really, it just needs a token it can send as part of the requests.
Of course this requires that the site uses OAuth/OIDC, but hopefully that's where things are headed.
- philsnow 3y agoI don't disagree.. but I stopped really using oauth when realizing that I could lose access to all those services if the whim of an algorithm closes my (oauth) account.
- magicalhippo 3y agoRight, but using OAuth doesn't mean using Google, Microsoft or Facebook for everything. It's common cause it's convenient, but has issues like you say. Someone running a Discourse forum could very well run say Ory[1] to have their own OAuth2 authentication service, if they wanted. Hopefully things like this will get a bit tighter integrated than it currently is. [1]: https://www.ory.sh/run-oauth2-server-open-source-api-security/ https://www.ory.sh/run-oauth2-server-open-source-api-securit...