13 ms·
Wow. This has pretty terrifying implications if people are using GitHub to sign into other services.
by tgsovlerkhgsel 3y ago
Wow. This has pretty terrifying implications if people are using GitHub to sign into other services.
- forgotpwd16 3y agoUsername and user ID are distinct. If username was the ID, you couldn't even change it yourself.
- tgsovlerkhgsel 3y agoThat assumes that all third party sites use the user ID, not the username. From my understanding, the way "login with Github" works is by the app getting an OAuth token, then querying a "give me the currently logged in user" API using that token, which then returns an object identical to https://api.github.com/users/rbishop https://api.github.com/users/rbishop If the client keys on "login" rather than "id" (this GitHub tutorial, for example, only mentions the former, not the latter: https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/building-a-login-with-github-button-with-a-github-app https://docs.github.com/en/apps/creating-github-apps/writing...) and then stores "github user rbishop can access account 123456 on our system", the new owner of the account name would likely be able to hijack the previous owner's 3rd party accounts.