News for hackers. Stuff that matters.

A comment on Ask HN: Is it better to centralize authentication at a security service?.

Re:Ask HN: Is it better to centralize authentication at a se... by CM30 on Wednesday April 20, 2016 @02:23PM (#11536556)
My worry would be if you end up on bad terms with said security service. Does this mean your site/app loses the ability to get sign ups till you move somewhere else? If so, that's a pretty big problem, especially if you do something controversial or the government has a hand in things.

That's one of the reasons I've always been skeptical of centralised anything. It's another potential group to fall out with or point of weakness.

[ Parent | on HN ]
Re:Ask HN: Is it better to centralize authentication at a se... by throwanem on Wednesday April 20, 2016 @02:37PM (#11536673)
"Centralized" doesn't mean you rely on Github or Google or Microsoft or whoever, although you can. It means you handle authentication and authorization with a service that does that job, instead of shared secrets or "well, it's on this VLAN, it must be OK". You can run your own OAuth2 (or whatever) provider pretty easily these days.
[ Parent | on HN ]