3 ms·

I think github is an example of those. 9 of 10 integrations just ask for blanket permissions. Effectively, "give us permissions to edit and make commits to all

by nox101 2y ago

I think github is an example of those. 9 of 10 integrations just ask for blanket permissions. Effectively, "give us permissions to edit and make commits to all of your repos, and every other possible thing that's possible to do on github and in return we'll setup everything so our service works for you immediately" Vs, here's 10 to 20 steps you can follow to give us the minimum permissions to use our service with a single repo. Go manually make repo specific tokens with specific permissions (10 steps) then go paste those tokens into our service (4-5 steps), now go add these actions to your repo (4-5 steps) and set these settings in that repo (5-15 steps) So in this case, security is at odds with UX. IMO, this is github's fault. Instead of providing an API and UX that would let users specify specific repos and choose specific permissions per repo, they did the more obvious and technically simpler thing. But, unfortunately, the more obvious easier thing, means the path of least resistance for integrations to do is ask for all permissions. I would argue you could paint that as github has not made security their top priority. If they cared about security then the path of least resistance would lead to the most secure integrations instead of what they have now which leads to the least secure integrations.

MattPalmer1086 2y ago
That's a great example of where the design space gets harder and requires more effort to do well, but not that security is inevitably at odds with UX. Just that it gets harder to design well. I think you're right about GitHub taking the most obvious route and prioritising UX over security. Managing permissions and getting to least privilege is a huge problem in security. If you rely on users to do it, they will pretty much always assign maximum perms. It's too much hassle to figure it all out, and maybe have something break later. Just spitballing, but maybe an alternate way would be for GitHub to require integrations to specify their least privilege permissions to operate in a manifest. Users would just approve an integration for whatever repos they like, and GitHub would set things up so it operated in least priv config for you in those repos. The user gets better security and a better UX. Maybe that wouldn't work for some reason, there are probably loads of things wrong with it. But my point is that further thought about the goals of the user (which includes having a secure system) could lead to a much better UX and better security.
- chii 2y ago
  It is in the interest of the integration to ask for maximum level of privilege, since it future proofs their app, and there is no cost to them (security breaches are externalities they don't pay for).

by nox101 2y ago

MattPalmer1086 2y ago

That's a great example of where the design space gets harder and requires more effort to do well, but not that security is inevitably at odds with UX. Just that it gets harder to design well. I think you're right about GitHub taking the most obvious route and prioritising UX over security. Managing permissions and getting to least privilege is a huge problem in security. If you rely on users to do it, they will pretty much always assign maximum perms. It's too much hassle to figure it all out, and maybe have something break later. Just spitballing, but maybe an alternate way would be for GitHub to require integrations to specify their least privilege permissions to operate in a manifest. Users would just approve an integration for whatever repos they like, and GitHub would set things up so it operated in least priv config for you in those repos. The user gets better security and a better UX. Maybe that wouldn't work for some reason, there are probably loads of things wrong with it. But my point is that further thought about the goals of the user (which includes having a secure system) could lead to a much better UX and better security.

chii 2y ago
It is in the interest of the integration to ask for maximum level of privilege, since it future proofs their app, and there is no cost to them (security breaches are externalities they don't pay for).