5 ms·

You forgot lock in. OIDC is an absolute nightmare for this. Watching everyone delegate all access control to Google and Microsoft is… I don’t even know what to

by api 3y ago

You forgot lock in. OIDC is an absolute nightmare for this. Watching everyone delegate all access control to Google and Microsoft is… I don’t even know what to say. It’s such an obvious trap but it’s convenient and convenience is the only thing anyone cares about. I’m gonna say I told you so in a few years. Nobody will care.

pphysch 3y ago
What "lock in"? If I use Google OIDC for my app, there's nothing stopping me from automatically migrating every Google user to a local account pre-populated with their Google claims, or from mapping those users to different identities, and permanently disabling Google OIDC.
- api 3y ago
  I’m talking about users. Can users change their login provider? Some apps allow this but most don’t.
  - clintonb 3y ago
    > Can users change their login provider? Some apps allow this but most don’t. You answered your own question. This is an issue with the app creator not supporting multiple providers, not with OIDC.
- donmcronald 3y ago
  I've never used it, but they can ban your app token, right? So I assume you need to make sure you're keeping your own up-to-date copy of all claims you have access to. > there's nothing stopping me from automatically migrating every Google user to a local account pre-populated with their Google claims I wonder your user retention would look like in that situation.
  - dikei 3y ago
    > I've never used it, but they can ban your app token, right? So I assume you need to make sure you're keeping your own up-to-date copy of all claims you have access to. That's why you should always provide multiple method of authentication. A simple way is fetching your user email from the OIDC provider, then use it for username/password authn. It's less convenient, but it prevents user from being locked out in case something's wrong with OIDC.
- alexvoda 3y ago
  Do you allow users to login with any identity provider they want by just providing a URL or do you lock them in to You, Google, and a few other options? You are not the one locked in, your users are. The original vision for OpenID was for users to own their identity. They could choose their identity provider (including self-hosted) by providing a URL. But it got distorted into Google/MS/FB/Apple owning your identity.
paulddraper 3y ago
??? OIDC doesn't increase lock in. Before, I had to (for example) generate AWS credentials, download them, and store them in GitHub Actions. But now, I can have GitHub Actions be directly authorized to access resources in AWS. The only "lock in" is that these two services support an open protocol that would be minorly annoying to give up.
donmcronald 3y ago
Even if it isn't total lock-in, OIDC is definitely encouraging consolidation and users have been trained to accept the idea of letting Google or Apple manage their logins. Identity is next. I think they'll start tying your Google, Apple, etc. account back to your real world ID. It'll be opt-in and they'll give some kind of sucker's reward for it like reduced captchas. It'll be sold to the public with the insinuation the "good guys" use verified IDs and the "bad guys" don't. > I’m gonna say I told you so in a few years. Nobody will care. Yep. Auth, identity, etc. are going to get sucked up by big tech and even after it happens we'll have people on HN telling us how awesome it is that we don't have any control over our digital lives because Google, Apple, etc. are "protecting" us. Case in point, the iOS app store. Passwordless tied back to biometrics is their endgame IMO.
- deleted 3y ago
  [deleted]
- userbinator 3y ago
  https://en.wikipedia.org/wiki/Mark_of_the_beast#Futurist_view https://en.wikipedia.org/wiki/Mark_of_the_beast#Futurist_vie... (I'm not even religious, but stuff like that really makes me wonder if Big Tech is taking inspiration from there, like they seem to be doing with 1984 and other dystopian fiction.)
- chickenfeed 3y ago
  I think Musk is hoping that Twitter can be this. But he should have edged in slowly to make Twitter Auth a trustable product. It now feels like a mess and has less authenticity. The UK government were going to delegate their age ID system to the porn industry. Can't say I have ever used Google, Microsoft or Apple ID beyond their own gardens it fills me with ick.
heavyset_go 3y ago
> I’m gonna say I told you so in a few years. Nobody will care. I recently stumbled upon this documentary[1] again, and it took me a while to realize I had seen it already a decade ago. In 2023, the whole video serves as an "I told you so", and you're right, nobody cares. [1] Panopticon (2012): https://www.youtube.com/watch?v=FUyB0Tsj6jE https://www.youtube.com/watch?v=FUyB0Tsj6jE
solatic 3y ago
> Watching everyone delegate all access control to Google and Microsoft is… I don’t even know what to say. Well really, the proper body to issue (digital) identity is the government, which already issues driver's licenses, passports, etc. Google and Microsoft aren't the best bodies to issue identity, they're just the ones that are picking up the ball when the public body best positioned to do so is inactive.
alexvoda 3y ago
It gets even more depressing when you remember that OpenID was initially meant to allow users to own their identity by self-hosting their identity server or delegating to a trusted entity. But logging in with a URL was unfamiliar to users and it was easier to click the Google button. It is so sad that this vision got so distorted by corporate interests into delegating to MS/FB/Google/Apple.

by api 3y ago

pphysch 3y ago

What "lock in"? If I use Google OIDC for my app, there's nothing stopping me from automatically migrating every Google user to a local account pre-populated with their Google claims, or from mapping those users to different identities, and permanently disabling Google OIDC.

api 3y ago
I’m talking about users. Can users change their login provider? Some apps allow this but most don’t.
- clintonb 3y ago
  > Can users change their login provider? Some apps allow this but most don’t. You answered your own question. This is an issue with the app creator not supporting multiple providers, not with OIDC.
donmcronald 3y ago
I've never used it, but they can ban your app token, right? So I assume you need to make sure you're keeping your own up-to-date copy of all claims you have access to. > there's nothing stopping me from automatically migrating every Google user to a local account pre-populated with their Google claims I wonder your user retention would look like in that situation.
- dikei 3y ago
  > I've never used it, but they can ban your app token, right? So I assume you need to make sure you're keeping your own up-to-date copy of all claims you have access to. That's why you should always provide multiple method of authentication. A simple way is fetching your user email from the OIDC provider, then use it for username/password authn. It's less convenient, but it prevents user from being locked out in case something's wrong with OIDC.
alexvoda 3y ago
Do you allow users to login with any identity provider they want by just providing a URL or do you lock them in to You, Google, and a few other options? You are not the one locked in, your users are. The original vision for OpenID was for users to own their identity. They could choose their identity provider (including self-hosted) by providing a URL. But it got distorted into Google/MS/FB/Apple owning your identity.

paulddraper 3y ago

??? OIDC doesn't increase lock in. Before, I had to (for example) generate AWS credentials, download them, and store them in GitHub Actions. But now, I can have GitHub Actions be directly authorized to access resources in AWS. The only "lock in" is that these two services support an open protocol that would be minorly annoying to give up.

donmcronald 3y ago

Even if it isn't total lock-in, OIDC is definitely encouraging consolidation and users have been trained to accept the idea of letting Google or Apple manage their logins. Identity is next. I think they'll start tying your Google, Apple, etc. account back to your real world ID. It'll be opt-in and they'll give some kind of sucker's reward for it like reduced captchas. It'll be sold to the public with the insinuation the "good guys" use verified IDs and the "bad guys" don't. > I’m gonna say I told you so in a few years. Nobody will care. Yep. Auth, identity, etc. are going to get sucked up by big tech and even after it happens we'll have people on HN telling us how awesome it is that we don't have any control over our digital lives because Google, Apple, etc. are "protecting" us. Case in point, the iOS app store. Passwordless tied back to biometrics is their endgame IMO.

deleted 3y ago
[deleted]
userbinator 3y ago
https://en.wikipedia.org/wiki/Mark_of_the_beast#Futurist_view https://en.wikipedia.org/wiki/Mark_of_the_beast#Futurist_vie... (I'm not even religious, but stuff like that really makes me wonder if Big Tech is taking inspiration from there, like they seem to be doing with 1984 and other dystopian fiction.)
chickenfeed 3y ago
I think Musk is hoping that Twitter can be this. But he should have edged in slowly to make Twitter Auth a trustable product. It now feels like a mess and has less authenticity. The UK government were going to delegate their age ID system to the porn industry. Can't say I have ever used Google, Microsoft or Apple ID beyond their own gardens it fills me with ick.

heavyset_go 3y ago

> I’m gonna say I told you so in a few years. Nobody will care. I recently stumbled upon this documentary[1] again, and it took me a while to realize I had seen it already a decade ago. In 2023, the whole video serves as an "I told you so", and you're right, nobody cares. [1] Panopticon (2012): https://www.youtube.com/watch?v=FUyB0Tsj6jE https://www.youtube.com/watch?v=FUyB0Tsj6jE

solatic 3y ago

> Watching everyone delegate all access control to Google and Microsoft is… I don’t even know what to say. Well really, the proper body to issue (digital) identity is the government, which already issues driver's licenses, passports, etc. Google and Microsoft aren't the best bodies to issue identity, they're just the ones that are picking up the ball when the public body best positioned to do so is inactive.

alexvoda 3y ago

It gets even more depressing when you remember that OpenID was initially meant to allow users to own their identity by self-hosting their identity server or delegating to a trusted entity. But logging in with a URL was unfamiliar to users and it was easier to click the Google button. It is so sad that this vision got so distorted by corporate interests into delegating to MS/FB/Google/Apple.