4 ms·

> Learning how to store passwords or add OAuth2 to your toy web site is not fun Hard disagree. OAuth2 is a neat technology and every personal thunk you run ac

> Learning how to store passwords or add OAuth2 to your toy web site is not fun Hard disagree. OAuth2 is a neat technology and every personal thunk you run across or find yourself asking "why the heck do I need to do this? why can't I just do x?) trying to implement it is an important part of security and instructive on how to build a secure system where you can only trust components to do a minimal thing. Storing passwords (or really salted password hashes) is similar.

jagged-chisel 2y ago
You have not convinced me this is "fun."
- ralferoo 2y ago
  It's just Stockholm syndrome...
superkuh 2y ago
OAuth 2 is definitely a "technology" and not a program. It is a tool for large corporations to create proprietary incompatible "OAuth" implementations. Whereas OAuth (1) was actually a program and it did what it said and was compatible. OAuth 2 is terrible corporate crapware. It is "open"auth like "open"ai is open. As for LANs, my home LAN is still going strong, no flakey wireless for me. My childhood friends group did stop having in-person LAN parties around 2009; mostly because we all moved to different regions. We still do occasionally set up a VPN to play some old non-internet game but it's mostly over the internet now (with self-hosted voice chat).
- DaiPlusPlus 2y ago
  > It is "open"auth like "open"ai is open. OAuth2 and OIDC are fully open specifications: anyone can join a working-group (there's no membership gatekeeping); and they both have plenty of fully open-source implementations. Not like OpenAI at all.
  - superkuh 2y ago
    Yes, OAuth2 is a toolkit that is open... for making proprietary non-interoptable auth solutions. One for each megacorp. That's why mail clients like Thunderbird have a directory full of configuration scripts written specifically for each proprietary oauth2 solution made by each megacorp. Mail clients that do not go out of their way to support each corporation's unique out of band OAuth2 HTTPS solution are unable to access these oauth2 megacorp email accounts anymore (see gmail, office365, yahoo, etc). OAuth2 has made email servers proprietary. Simply supporting smtp or pop3 or imap is no longer sufficient. Custom HTTPS scripting has to be made for each corp and one corp's scripting won't work for another's login process. OAuth2 has been the email tower of babel.
hot_gril 2y ago
It's been a long time since I've used Oauth2, and I don't remember how it works, I only remember pain.
- deleted 2y ago
  [deleted]

jagged-chisel 2y ago

You have not convinced me this is "fun."

ralferoo 2y ago
It's just Stockholm syndrome...

superkuh 2y ago

OAuth 2 is definitely a "technology" and not a program. It is a tool for large corporations to create proprietary incompatible "OAuth" implementations. Whereas OAuth (1) was actually a program and it did what it said and was compatible. OAuth 2 is terrible corporate crapware. It is "open"auth like "open"ai is open. As for LANs, my home LAN is still going strong, no flakey wireless for me. My childhood friends group did stop having in-person LAN parties around 2009; mostly because we all moved to different regions. We still do occasionally set up a VPN to play some old non-internet game but it's mostly over the internet now (with self-hosted voice chat).

DaiPlusPlus 2y ago
> It is "open"auth like "open"ai is open. OAuth2 and OIDC are fully open specifications: anyone can join a working-group (there's no membership gatekeeping); and they both have plenty of fully open-source implementations. Not like OpenAI at all.
- superkuh 2y ago
  Yes, OAuth2 is a toolkit that is open... for making proprietary non-interoptable auth solutions. One for each megacorp. That's why mail clients like Thunderbird have a directory full of configuration scripts written specifically for each proprietary oauth2 solution made by each megacorp. Mail clients that do not go out of their way to support each corporation's unique out of band OAuth2 HTTPS solution are unable to access these oauth2 megacorp email accounts anymore (see gmail, office365, yahoo, etc). OAuth2 has made email servers proprietary. Simply supporting smtp or pop3 or imap is no longer sufficient. Custom HTTPS scripting has to be made for each corp and one corp's scripting won't work for another's login process. OAuth2 has been the email tower of babel.

hot_gril 2y ago

It's been a long time since I've used Oauth2, and I don't remember how it works, I only remember pain.

deleted 2y ago
[deleted]