4 ms·

In general, you may be right, but the security suggestions in this particular post are the same I hear from people "who have experience in security." Also, the

by jaawn 11y ago

In general, you may be right, but the security suggestions in this particular post are the same I hear from people "who have experience in security." Also, they often encourage readers to basically go out and find the thing everyone says is the best thing (i.e. "When storing passwords, salt and hash them first, using an existing, widely used crypto library.") I challenge you to point out specific suggestions in this article which are wrong or misleading, or to point out glaring omissions.

grey-area 11y ago
There are quite a few misleading or incorrect suggestions, to pick a few: Encryption passwords is not hashing (think this was fixed after publishing due to comments below) OAuth is not for authentication SPA is not suited to all or even most websites, and is far from being 'king' in any sense. CDNs have pros and cons, they don't suit everyone. Localisation does not mean serving assets closer to home, but translating stuff. Nothing better than SSL? TLS
- jaawn 11y ago
  Most (all?) encryption functions are also hash functions, they're just special hash functions with the extra property of making it extremely difficult to discover the source. (edit: I realized after posting this, that this item is incorrect in regards to the cipher text, which obviously changes in length in relation to the length of the source, unlike the output of a hash function which is a fixed length) If OAuth is not for authentication, someone better tell Google: "Google APIs use the OAuth 2.0 protocol for authentication and authorization." [1] TLS is basically just the newest version of SSL. The name was changed for legal reasons. So it is an understandable oversight [2] The others aren't security related, so I didn't address them. [1] https://developers.google.com/identity/protocols/OAuth2 https://developers.google.com/identity/protocols/OAuth2 [2] http://security.stackexchange.com/questions/5126/whats-the-difference-between-ssl-tls-and-https http://security.stackexchange.com/questions/5126/whats-the-d...
  - dragonwriter 11y ago
    > Most (all?) encryption functions are also hash functions, they're just special hash functions with the extra property of making it extremely difficult to discover the source. The special property that encryption functions have compared to hashing functions isn't that it is extremely difficult to discover the source, but rather almost the reverse -- that for every encryption function there exists a function (decryption function) by which you can recover the unique source. Hashing functions in general do not have an inverse function: while you might be able to recover several possible sources from them (and this might be easy or difficult), you cannot recover the single source, because the space of inputs is larger than the space of outputs, so there can be no unique mapping from outputs back to inputs that would generate them.
  - grey-area 11y ago
    Most (all?) encryption functions are also hash functions, they're just special hash functions with the extra property of making it extremely difficult to discover the source. There's a fundamental difference between storing a password so that you can read it again (encrypt implies this), and storing it so that you can only verify it, not read it (hash). But a broader criticism of the article is that it is far too sweeping in its judgements based on scant knowledge of the topic - the little mistakes are just indications of that. It's fine to be a beginner asking questions and the mistakes are not really so important, but it's not really useful to attempt a definitive summary of a field which you know very little about.
  - balls187 11y ago
    OAuth isn't for Identification. You can use OAuth for authentication, but that is specific purpose for Authorization. Google has a separate product for Sign In: https://developers.google.com/identity/sign-in/web/ https://developers.google.com/identity/sign-in/web/
- cpitman 11y ago
  Can you explain why OAuth is not for authentication? What does it not do that you expect an authentication system to do? What is fundamentally wrong with every site that allows me to sign in with a github/google/facebook account (via OAuth)?
  - grey-area 11y ago
    People usually use OpenID for that bit and OAuth for the authorisation to use the third party APIs as the customer. There's nothing horribly wrong with third-party signin if it suits you and for smaller projects however it does limit your relationship with customers and tie you in to third party services which might be charged for or shut down at any time, so it's not ideal for many websites. It depends on your requirements.
  - balls187 11y ago
    > What is fundamentally wrong with every site that allows me to sign in with a github/google/facebook account (via OAuth)? That is a inaccurate statement. Those sites allow you to login with your Github/Facebook/Google Accounts. That isn't OAuth. Those sites also use OAuth in order to let 3rd party applications access the users data stored on that system. Take this Scenario Alan has a service that finds funny tweets. cpitman wants to use Alan's service, to find his funny tweets. No OAuth Example: cpitman gives Alan service his Twitter Username and Password. Alan service logs into Twitter, and pulls twitter data. With OAuth: Alan service opens a request to Twitter asking for twitter data for cpitman Alan service redirects cpitman to Twitter Twitter notifies cpitman that Alan Service wants to access twitter data cpitman agrees Twitter passes back a token Alan service uses token to access cpitman twitter data.
    - avinassh 11y ago
      but the email ID he used to register at Twitter is also one of resources associated with his account and can be accessed as Twitter Data? (beginner here, trying to understand why not use OAuth for Identification/Authentication)
  - balls187 11y ago
balls187 11y ago
My first comment on this article was pointing out that Facebook Login et al isn't OAuth. I am guilty of not editing that one comment to hang my other comment off of.

by jaawn 11y ago

grey-area 11y ago

There are quite a few misleading or incorrect suggestions, to pick a few: Encryption passwords is not hashing (think this was fixed after publishing due to comments below) OAuth is not for authentication SPA is not suited to all or even most websites, and is far from being 'king' in any sense. CDNs have pros and cons, they don't suit everyone. Localisation does not mean serving assets closer to home, but translating stuff. Nothing better than SSL? TLS

jaawn 11y ago
Most (all?) encryption functions are also hash functions, they're just special hash functions with the extra property of making it extremely difficult to discover the source. (edit: I realized after posting this, that this item is incorrect in regards to the cipher text, which obviously changes in length in relation to the length of the source, unlike the output of a hash function which is a fixed length) If OAuth is not for authentication, someone better tell Google: "Google APIs use the OAuth 2.0 protocol for authentication and authorization." [1] TLS is basically just the newest version of SSL. The name was changed for legal reasons. So it is an understandable oversight [2] The others aren't security related, so I didn't address them. [1] https://developers.google.com/identity/protocols/OAuth2 https://developers.google.com/identity/protocols/OAuth2 [2] http://security.stackexchange.com/questions/5126/whats-the-difference-between-ssl-tls-and-https http://security.stackexchange.com/questions/5126/whats-the-d...
- dragonwriter 11y ago
  > Most (all?) encryption functions are also hash functions, they're just special hash functions with the extra property of making it extremely difficult to discover the source. The special property that encryption functions have compared to hashing functions isn't that it is extremely difficult to discover the source, but rather almost the reverse -- that for every encryption function there exists a function (decryption function) by which you can recover the unique source. Hashing functions in general do not have an inverse function: while you might be able to recover several possible sources from them (and this might be easy or difficult), you cannot recover the single source, because the space of inputs is larger than the space of outputs, so there can be no unique mapping from outputs back to inputs that would generate them.
- grey-area 11y ago
  Most (all?) encryption functions are also hash functions, they're just special hash functions with the extra property of making it extremely difficult to discover the source. There's a fundamental difference between storing a password so that you can read it again (encrypt implies this), and storing it so that you can only verify it, not read it (hash). But a broader criticism of the article is that it is far too sweeping in its judgements based on scant knowledge of the topic - the little mistakes are just indications of that. It's fine to be a beginner asking questions and the mistakes are not really so important, but it's not really useful to attempt a definitive summary of a field which you know very little about.
- balls187 11y ago
  OAuth isn't for Identification. You can use OAuth for authentication, but that is specific purpose for Authorization. Google has a separate product for Sign In: https://developers.google.com/identity/sign-in/web/ https://developers.google.com/identity/sign-in/web/
cpitman 11y ago
Can you explain why OAuth is not for authentication? What does it not do that you expect an authentication system to do? What is fundamentally wrong with every site that allows me to sign in with a github/google/facebook account (via OAuth)?
- grey-area 11y ago
  People usually use OpenID for that bit and OAuth for the authorisation to use the third party APIs as the customer. There's nothing horribly wrong with third-party signin if it suits you and for smaller projects however it does limit your relationship with customers and tie you in to third party services which might be charged for or shut down at any time, so it's not ideal for many websites. It depends on your requirements.
- balls187 11y ago
  > What is fundamentally wrong with every site that allows me to sign in with a github/google/facebook account (via OAuth)? That is a inaccurate statement. Those sites allow you to login with your Github/Facebook/Google Accounts. That isn't OAuth. Those sites also use OAuth in order to let 3rd party applications access the users data stored on that system. Take this Scenario Alan has a service that finds funny tweets. cpitman wants to use Alan's service, to find his funny tweets. No OAuth Example: cpitman gives Alan service his Twitter Username and Password. Alan service logs into Twitter, and pulls twitter data. With OAuth: Alan service opens a request to Twitter asking for twitter data for cpitman Alan service redirects cpitman to Twitter Twitter notifies cpitman that Alan Service wants to access twitter data cpitman agrees Twitter passes back a token Alan service uses token to access cpitman twitter data.
  - avinassh 11y ago
    but the email ID he used to register at Twitter is also one of resources associated with his account and can be accessed as Twitter Data? (beginner here, trying to understand why not use OAuth for Identification/Authentication)
- balls187 11y ago

balls187 11y ago

My first comment on this article was pointing out that Facebook Login et al isn't OAuth. I am guilty of not editing that one comment to hang my other comment off of.