4 ms·

> Hopefully, this post helps clear that up! Thanks, it did not. OAuth and OpenID Connect are a denial of service attack on the brains of the humans who have t

> Hopefully, this post helps clear that up! Thanks, it did not. OAuth and OpenID Connect are a denial of service attack on the brains of the humans who have to work with them.

BrandoElFollito 8mo ago
I use OIDC in my home lab (with Authelia). It is very simple to work with it. I do not understand what I am doing and trust the docs, but it has never been a particularly difficult setup.
- SahAssar 8mo ago
  > I do not understand what I am doing I would argue that then you do not "have to work with them", you are merely using products built with them.
- layer8 8mo ago
  The article is answering a request for explanation of how it works, however. In other words, they do want to understand.
TZubiri 8mo ago
A has an account at B, A has another account at C, A wants to allow C to access data at B (or to send data to B on A's behalf). How can B be sure that C is acting on A's behalf? Can A only allow C to access certain data (or send only certain data) in order to reduce risk? A protocol that allows for that three way negotiation is OAuth. Like with most specs, a lot of the complexity is added in the later years, by companies that have thousands of users and complex edge cases and necessities, and they are the ones dominating the council, and their needs are the ones that push forward newer versions. So with most specs, the best way to start learning it is by learning from the oldest specs to the newest ones, so if you start by reading or using OAuth2, you will be bombarded with a lot of extra complexities, not even the current experts started like that. If you need to catch up, always start with the oldest specs/versions.
- mettamage 8mo ago
  Wow, that was a really valuable lesson. I wish I had this one at university. But the next best time to have it, is now. So thanks! I'll start reading the oldest HTTP spec for funzies.
  - TZubiri 8mo ago
    That'd be RFC (checks notes) 1945 for HTTP1.0 and later RFC (checks notes again) 2616 for HTTP 1.1. I think there's HTTP 0.9 but I went directly for 1.0 Fwiw it's entirely possible to build a web server by listening on port 80 and reading the text stream and writing to the output stream, no libraries no frameworks no apache no ngninx. And I don't mean you need to rebuild a general purpose an apache like server, maybe for a landing page you can just serve a static page and you will be implementing a very small subset of HTTP.
    - mettamage 8mo ago
      Haha, thanks! I'll check them out. > Fwiw it's entirely possible to build a web server by listening on port 80 and reading the text stream and writing to the output stream Sounds like a fun weekend project.
frizlab 8mo ago
I have implemented OAuth both as a client and a server. The most complicated part is the scattered documentation, and little gotchas from different providers. In itself, the whole thing is not complex.
- user3939382 8mo ago
  > The whole thing is not complex Meanwhile https://www.couchbase.com/blog/wp-content/uploads/2021/05/oauth2-auth-code.png https://www.couchbase.com/blog/wp-content/uploads/2021/05/oa...
  - everybodyknows 8mo ago
    The diagram shows five boxes, apparently each representing a server, but I am not at all clear on which (of exactly two?) legal business entities controls certain of those servers.
  - magicalhippo 8mo ago
    That's just a very confusing diagram of the process, which has multiple separate boxes for the same entities. The diagram on Microsoft's page[1] for that exact same scenario/flow is much clearer IMHO. [1]: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow https://learn.microsoft.com/en-us/entra/identity-platform/v2...
    - kennywinker 8mo ago
      I hope this was meant as a joke…
      - magicalhippo 8mo ago
        Why would it? The first diagram is literally all over, with just small labels to remind you that this box over here relates to that box over there. The Microsoft diagram clearly show the parties involved, who they communicate with and in which sequence. As I mentioned in another post, I found the MS pages very helpful to understand OAuth 2.0, and the clear diagrams was a large part of that.
hahn-kev 8mo ago
No you're thinking of SAML.
- bob1029 8mo ago
  SAML is the devil. If it weren't for its XML aspects we'd probably not have bothered as much with alternatives.
  - tptacek 8mo ago
    SAML is bad semantically too, not just because of XML. SAML is arguably the worst cryptographic standard ever created.
    - dadrian 8mo ago
      > SAML is arguably the worst cryptographic standard ever created The PGP packet has entered the chat.
clarkdale 8mo ago
Completely agree. OAuth, Auth0, Okta, OIDC.

> Hopefully, this post helps clear that up! Thanks, it did not. OAuth and OpenID Connect are a denial of service attack on the brains of the humans who have to work with them.

BrandoElFollito 8mo ago

I use OIDC in my home lab (with Authelia). It is very simple to work with it. I do not understand what I am doing and trust the docs, but it has never been a particularly difficult setup.

SahAssar 8mo ago
> I do not understand what I am doing I would argue that then you do not "have to work with them", you are merely using products built with them.
layer8 8mo ago
The article is answering a request for explanation of how it works, however. In other words, they do want to understand.

TZubiri 8mo ago

A has an account at B, A has another account at C, A wants to allow C to access data at B (or to send data to B on A's behalf). How can B be sure that C is acting on A's behalf? Can A only allow C to access certain data (or send only certain data) in order to reduce risk? A protocol that allows for that three way negotiation is OAuth. Like with most specs, a lot of the complexity is added in the later years, by companies that have thousands of users and complex edge cases and necessities, and they are the ones dominating the council, and their needs are the ones that push forward newer versions. So with most specs, the best way to start learning it is by learning from the oldest specs to the newest ones, so if you start by reading or using OAuth2, you will be bombarded with a lot of extra complexities, not even the current experts started like that. If you need to catch up, always start with the oldest specs/versions.

mettamage 8mo ago
Wow, that was a really valuable lesson. I wish I had this one at university. But the next best time to have it, is now. So thanks! I'll start reading the oldest HTTP spec for funzies.
- TZubiri 8mo ago
  That'd be RFC (checks notes) 1945 for HTTP1.0 and later RFC (checks notes again) 2616 for HTTP 1.1. I think there's HTTP 0.9 but I went directly for 1.0 Fwiw it's entirely possible to build a web server by listening on port 80 and reading the text stream and writing to the output stream, no libraries no frameworks no apache no ngninx. And I don't mean you need to rebuild a general purpose an apache like server, maybe for a landing page you can just serve a static page and you will be implementing a very small subset of HTTP.
  - mettamage 8mo ago
    Haha, thanks! I'll check them out. > Fwiw it's entirely possible to build a web server by listening on port 80 and reading the text stream and writing to the output stream Sounds like a fun weekend project.

frizlab 8mo ago

I have implemented OAuth both as a client and a server. The most complicated part is the scattered documentation, and little gotchas from different providers. In itself, the whole thing is not complex.

user3939382 8mo ago
> The whole thing is not complex Meanwhile https://www.couchbase.com/blog/wp-content/uploads/2021/05/oauth2-auth-code.png https://www.couchbase.com/blog/wp-content/uploads/2021/05/oa...
- everybodyknows 8mo ago
  The diagram shows five boxes, apparently each representing a server, but I am not at all clear on which (of exactly two?) legal business entities controls certain of those servers.
- magicalhippo 8mo ago
  That's just a very confusing diagram of the process, which has multiple separate boxes for the same entities. The diagram on Microsoft's page[1] for that exact same scenario/flow is much clearer IMHO. [1]: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow https://learn.microsoft.com/en-us/entra/identity-platform/v2...
  - kennywinker 8mo ago
    I hope this was meant as a joke…
    - magicalhippo 8mo ago
      Why would it? The first diagram is literally all over, with just small labels to remind you that this box over here relates to that box over there. The Microsoft diagram clearly show the parties involved, who they communicate with and in which sequence. As I mentioned in another post, I found the MS pages very helpful to understand OAuth 2.0, and the clear diagrams was a large part of that.

hahn-kev 8mo ago

No you're thinking of SAML.

bob1029 8mo ago
SAML is the devil. If it weren't for its XML aspects we'd probably not have bothered as much with alternatives.
- tptacek 8mo ago
  SAML is bad semantically too, not just because of XML. SAML is arguably the worst cryptographic standard ever created.
  - dadrian 8mo ago
    > SAML is arguably the worst cryptographic standard ever created The PGP packet has entered the chat.

clarkdale 8mo ago

Completely agree. OAuth, Auth0, Okta, OIDC.