4 ms·

The complexities of OAuth make me want to go solve an NTLM double-hop problem with a three headed dog. Why are we seeing so many implementation mistakes? Is OA

The complexities of OAuth make me want to go solve an NTLM double-hop problem with a three headed dog. Why are we seeing so many implementation mistakes? Is OAuth simply too difficult?

mooreds 3y ago
I think it's because * it's a framework for authorization, with at least 8 different ways of using it (https://fusionauth.io/docs/v1/tech/core-concepts/modes https://fusionauth.io/docs/v1/tech/core-concepts/modes has more) * authentication is not most folks core competency
belter 3y ago
According to the lead author and editor of OAuth 2.0, (who asked that is name be removed from the spec) is: "a bad protocol." Developer Quits OAuth 2.0 Spec, Calls It 'a Bad Protocol' - https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec-calls-it-a-bad-protocol/ https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec... "OAuth 2.0 and the Road to Hell" - https://news.ycombinator.com/item?id=4294959 https://news.ycombinator.com/item?id=4294959
- peter_l_downs 3y ago
  Strongly recommend reading this, as well as looking up Homakov's exploits. My opinion is that OAuth 2.0 is a very bad spec because in practice people do not implement it correctly. As to why? Maybe it's that the spec is split across multiple RFCs, and defines many insecure behaviors as compliant, and authorization is just hard. When Facebook, Twitter, Github, etc. all got burned at various points in time with their OAuth implementations, you have to start looking for the common denominator.
  - lylejantzi3rd 3y ago
    > My opinion is that OAuth 2.0 is a very bad spec because in practice people do not implement it correctly. Can we just stop using oauth entirely, then? There's got to be something better.
    - paulddraper 3y ago
      Oauth 2.1 > Keep in mind that when OAuth 2.0 was published in 2012, the iPhone 5 was brand new, the latest browser from Microsoft was Internet Explorer 9, single-page apps were called “AJAX apps”, and CORS was not yet an established W3C standard.
dwaite 3y ago
A big part is bespoke authentication on top of OAuth, rather than correctly implementing an actual standard to do such (OpenID Connect). OAuth is not an authentication protocol, it only gives guidance for delegated authorization. OpenID Connect gives a mandated list of steps for verification. Facebook Connect really only is supported via usage by an official SDK. If you are using an implementation that reverse engineered support for Facebook Connect rather than using the official SDK, you are on your own.
az09mugen 3y ago
It's funnier when you know microsoft will abandon ntlm https://www.bleepingcomputer.com/news/security/microsoft-plans-to-kill-off-ntlm-authentication-in-windows-11/ https://www.bleepingcomputer.com/news/security/microsoft-pla...

The complexities of OAuth make me want to go solve an NTLM double-hop problem with a three headed dog. Why are we seeing so many implementation mistakes? Is OAuth simply too difficult?

mooreds 3y ago

I think it's because * it's a framework for authorization, with at least 8 different ways of using it (https://fusionauth.io/docs/v1/tech/core-concepts/modes https://fusionauth.io/docs/v1/tech/core-concepts/modes has more) * authentication is not most folks core competency

belter 3y ago

According to the lead author and editor of OAuth 2.0, (who asked that is name be removed from the spec) is: "a bad protocol." Developer Quits OAuth 2.0 Spec, Calls It 'a Bad Protocol' - https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec-calls-it-a-bad-protocol/ https://www.wired.com/2012/07/developer-quits-oauth-2-0-spec... "OAuth 2.0 and the Road to Hell" - https://news.ycombinator.com/item?id=4294959 https://news.ycombinator.com/item?id=4294959

peter_l_downs 3y ago
Strongly recommend reading this, as well as looking up Homakov's exploits. My opinion is that OAuth 2.0 is a very bad spec because in practice people do not implement it correctly. As to why? Maybe it's that the spec is split across multiple RFCs, and defines many insecure behaviors as compliant, and authorization is just hard. When Facebook, Twitter, Github, etc. all got burned at various points in time with their OAuth implementations, you have to start looking for the common denominator.
- lylejantzi3rd 3y ago
  > My opinion is that OAuth 2.0 is a very bad spec because in practice people do not implement it correctly. Can we just stop using oauth entirely, then? There's got to be something better.
  - paulddraper 3y ago
    Oauth 2.1 > Keep in mind that when OAuth 2.0 was published in 2012, the iPhone 5 was brand new, the latest browser from Microsoft was Internet Explorer 9, single-page apps were called “AJAX apps”, and CORS was not yet an established W3C standard.

dwaite 3y ago

A big part is bespoke authentication on top of OAuth, rather than correctly implementing an actual standard to do such (OpenID Connect). OAuth is not an authentication protocol, it only gives guidance for delegated authorization. OpenID Connect gives a mandated list of steps for verification. Facebook Connect really only is supported via usage by an official SDK. If you are using an implementation that reverse engineered support for Facebook Connect rather than using the official SDK, you are on your own.

az09mugen 3y ago

It's funnier when you know microsoft will abandon ntlm https://www.bleepingcomputer.com/news/security/microsoft-plans-to-kill-off-ntlm-authentication-in-windows-11/ https://www.bleepingcomputer.com/news/security/microsoft-pla...