vwpolo3
Joined 7 years ago
Karma
206
Submissions
27
Member since
Dec 27
Recent submissions
Comment · 5 years ago
Comment · 5 years ago
It explains why OAuth2 is hard to use and does not solve login, registration, sessions, profile management, mfa, and proposes another solution. It’s all open source! :)
Comment · 5 years ago
The first vulnerability is in the title, OAuth is an Authorization framework (Open Authorization) and is explicitly NOT for authentication. It’s also a delegation protocol (I give you something to do on my behalf).
If you want a list of things that can go wrong, look here: https://tools.ietf.org/id/draft-ietf-oauth-security-topics-1...
Generally you probably do not need OAuth2: https://www.ory.sh/hydra/docs/concepts/before-oauth2/
But if you do don’t roll your own but use proven open source like https://github.com/ory/hydra
Comment · 5 years ago
Don't forget Ory:
Comment · 5 years ago
There are already true open source alternatives on the horizon such as https://github.com/ory
It is about time for a new generation of identity systems in my opinion. This acquisition shows the risk of centralized, vendor locked-in services.
Comment · 6 years ago
Don't implement your own, there's tons of open source that can do that, for example https://github.com/ory/hydra
Comment · 6 years ago
Without upgrade, this might be exploited through package managers able to fetch from Git URLs (so NPM, Go Modules, and others).
Comment · 6 years ago
Ory | Open Source Software Engineer (Go, React) | FULLTIME | ONSITE in Munich Germany
We build stuff for an emerging cloud infrastructure. It's security, zero trust, hardcore bullet proof engineering. It's Golang, K8S, React, Hashicorp etc. - no more buzzwords! We are looking for people with a broad set of technical skills who are ready to take on some of technology's challenges and work with others to create modern world class solutions. We like React, Go and Kubernetes (among other things) and love learning how to push the boundaries with those technologies! Drop us a short introductory email to [email protected]. We believe that great engineering deserves to be paid accordingly.
https://github.com/ory https://github.com/ory/jobs https://www.ory.sh
Comment · 6 years ago
The problem is that online news sources are (almost) all the same - low budget, second tier silos of mostly trainee journalists. They have an emphasis on clicks and outrage and constant updates to keep you engaged and are a secondary (or tertiary) driver of revenue. The only exception I know of are The New York Times and maybe The Intercept.
My tip is to read a (or more) actual (read: printed) newspapers:
- they are printed daily or weekly (e.g. The Economist), keeping you out of the "Breaking News" loop every 60 minutes; - they have more weight within the news organization because they are the primary driver of revenue; - are therefore written by actual professional journalists in a proper journalistic process.
I recommend just picking up any news paper and comparing that to the online presence of that news paper, you will notice the tremendous difference.
In my opinion, a lot of the "media mistrust" comes from the constant barrage of so-called "news" articles with the primary goal of being shared on social media and bubbling up in Google News. Just check how many news articles are 1:1 copies of AP or any other news conglomerate.
- https://oauth.net/articles/authentication/
- https://tools.ietf.org/html/rfc6749 - The OAuth 2.0 Authorization Framework