6 ms·
What really grinds my gears about OAuth is when there’s 5 providers, plus an email signup, and I forgot which one I used last time. Then I end up creating a new
by teeray 2y ago
What really grinds my gears about OAuth is when there’s 5 providers, plus an email signup, and I forgot which one I used last time. Then I end up creating a new account accidentally, sometimes with no way to retrieve the old one.
- boopdewoop 2y agoAgreed, I have seen some sites check the email used and link the account instead of creating a new one. I much prefer this.
- lxgr 2y agoOn one hand I like that feature – on the other hand it somewhat terrifies me, since it essentially delegates email verification to any of their accepted OAuth providers, unless they make you re-authenticate using your existing credentials, or redo email verification, upon linking the accounts. And not nearly all sites do.
- merb 2y agoonly works with email validation. Sadly some providers don’t do this (not even Microsoft azure ad in some cases…)
- dotancohen 2y agoSome OAuth users, e.g. from Facebook, don't even have an email address associated with the account. Just a phone number.
- eastbound 2y agoSecurity breach: For a target with a Gmail account, create an account on an unsecured OAuth provider, login to such sites with the unsecured email, access their data because it allows auth with any OAuth provider.
- ascorbic 2y agoDo any sites allow login from any OAuth provider? How would that even work? Providers need client IDs and client secrets.
- dotancohen 2y agoThe intent was probably "multiple", not "any".
- portaouflop 2y agoEasily preventable. Ask the user to supply a credential before linking the accounts or only allow account linking if the email is verified at the idp (as someone else noted this is not possible for all idps but for google it is)
- jrockway 2y ago1password's browser extension attempts to record this for you.
- jerieljan 2y agoI worked around this problem by adding an entry in my password manager with a username of "OAuth: Use Google" or something like that, so I'm informed when I habitually check my browser extension or when I attempt to auto-fill during login. It's inelegant and could be better, but good enough.
- bigfatkitten 2y agoI don't know about other password managers, but 1Password can track this for you automatically.
- alex_duf 2y ago1 password does this automatically
- prophesi 2y agoIf you use a password manager (and my condolences to those who don't), there's really no benefit to using OAuth over an email sign up. It can prepopulate your personal information, but I usually don't want that for the services I sign up for.
- bigfatkitten 2y ago> there's really no benefit to using OAuth over an email sign up Except for the really big one, which is strong MFA provided by the identity provider even when the site doesn't support it natively.
- flir 2y agoThere's a couple of services where I prefer to use github for sso because I need them to integrate with data stored there, and it makes sense to me to "bundle" those accounts. But that's very much an edge case. Is this where I complain about companies that insist I install their MFA app rather than just letting me use Google Authenticator? You're not special.
- 8n4vidtmkvmk 2y ago
- portaouflop 2y agoIf you (the service you are signing up to) use a good auth solution it will prevent that and give you the option to merge the 2 identities (matching on the email address) sadly most don’t care about how bad their authN is which is mind boggling to me but reality
- michaelt 2y agoIs that the right behaviour? Imagine the following scenario: An evildoer hacks into my e-mail account, michaelt@example.com, creates a salesforce.com account (with a password). They delete all the e-mails about account creation. I discover the hack and change the passwords on every account I know about - but I don't know about the salesforce account (in fact I don't have the password to it) so the hacker retains access. Should the hacker be able to visit gitlab.com, hit the log-in-with-salesforce button, and get access to the michaelt@example.com account?
- swishman 2y agoYou have to verify access to the email with a code to do the merge. That solves your issue
- Wingy 2y agoBut what if the attacker deleted the verification email after they merged the GitLab accounts? Then they still have a backdoor to your GitLab.
- eitland 2y agoAs far as I can see you are assuming an attacker with permanent access to your main email account. If someone has persistent to your main email account you will have all kinds of problems.
- cruffle_duffle 2y agoAs somebody else said, once your email is compromised you are fucked and have far larger problems than a single individual site.
- penteract 2y agoI've encountered a Matrix server/Element client that doesn't always present the same options for providers, making it very difficult to log in on a second machine.
- Arathorn 2y agothis is why Matrix is switching to native OIDC rather than the current messy mix: https://areweoidcyet.com https://areweoidcyet.com
- creesch 2y agoThe simple solution is to do email signup in my opinion. I don't want to be beholden to oauth providers for my account. A lot of services that provide OAuth signup/signin do it in a way that locks you out of the account if you can't use the OAuth provider anymore.
- CGamesPlay 2y agoPSA: you can often "upgrade" to email/password auth on sites that support it by doing a normal "forgot password" flow with the same email address as your OAuth account.
- cruffle_duffle 2y agoSometimes. It depends on how they bind your account. On the projects I’ve worked on, we’d always “upgrade” but I’ve seen plenty of sites that just create a new account. A behavior I find very annoying. I have noticed a trend in many sites to reduce the number of social signin options down to maybe google (for android) and apple (for iOS) plus email / password. I suspect the “which signin method did I use” is one of the main reasons. That and clutter reduction. By the way one of the big reasons a site might push you toward social signin is because those accounts are usually already verified. When you run through your own email / password flow you need to verify the email yourself (if that is important to your product). It’s an extra step that doesn’t need to happen when you click the magic google / apple button.
- creesch 2y agoKey word is "often", I have heard too many stories where that is not the case.
- bluGill 2y agoThat is the beauty of password managers these days: I can manage a separate password for everything and it syncs to all my computers. Plus by using a password manager I give the big players less ability to track me. (they still track me, but I'm not logged into them in the tab they are tracking which leaves some doubt for their algorithms)
- 2y ago
- Suppafly 2y ago>What really grinds my gears about OAuth is when there’s 5 providers, plus an email signup, and I forgot which one I used last time. Yeah there are a couple of sites where I do the login with google, but most of the time I go through the steps of making a real account specifically because of this issue. There should be a way to tell if you already have an oauth account without it just making you a new account if you choose the wrong method.
- Manouchehri 2y agoWhat I did, was write logic to link accounts together via an automatic email confirmation. Try visiting this URL twice, but use two different login methods (that use the same address). https://auth.ai.moda/pages/v1.0.0/login https://auth.ai.moda/pages/v1.0.0/login