4 ms·
Nope. The thing about cryptography you always hear being said is "don't roll your own crypto", because you don't know all the complexities and failure modes th
by arka2147483647 3y ago
Nope.
The thing about cryptography you always hear being said is "don't roll your own crypto", because you don't know all the complexities and failure modes that experts have researched.
In o-auth, just you comment mentions multiple ways of doing things, and different responsibilities the developers have in different circumstances. Essentially the developer is forced roll some of their own auth.
Compare that, for example, to say how you use TLS. You just use the standard libs bundled everywhere, and open connection, and the the system does all the validation for you. The complexity is there, but average developer is not expected to understand it.
O-auth simply exposes too many details to the average developer, and too many options to use them differently, for it to ever be secure.
- robertlagrant 3y agoWhile what you say is true about OAuth2, this isn't what "don't roll your own crypto" refers to, I think. It's more like "don't start implementing crypto routines yourself".
- jillesvangurp 3y agoThat's just the way oauth works. I agree it's a messy protocol. Classic design by committee stuff. Exactly what you get when mutually incompatible security product vendors try to create a standard that covers what all of them do. Unfortunately, there are no good alternatives that don't have this problem. Basically people use all sorts of commercial products in the hopes that it will act like magic security pixie dust. Most of them are super complicated to work with. Or expensive. Or both. There's just no way around the fact that you need to know what you are doing and how stuff sticks together.