News for hackers. Stuff that matters.

A comment on Show HN: A microservice that makes adding authentication to your app easy. Parent comment

Re:Show HN: A microservice that makes adding authentication ... by homakov on Monday February 20, 2017 @12:55AM (#13684679)
That attack is trivially fixed - just inspect token and see its app id. But no one should use oauth for auth.
[ Parent | on HN ]
Re:Show HN: A microservice that makes adding authentication ... by pluma on Monday February 20, 2017 @03:55AM (#13685621)
Maybe I'm missing something but isn't every single "social login" effectively using OAuth for auth?
[ Parent | on HN ]
Re:Show HN: A microservice that makes adding authentication ... by homakov on Monday February 20, 2017 @05:35AM (#13686155)
Yes. Some apps without sensitive info can do it, but that's it.
[ Parent | on HN ]
Re:Show HN: A microservice that makes adding authentication ... by pluma on Monday February 20, 2017 @10:39AM (#13688119)
So in other words StackOverflow etc (i.e. all non-trivial apps that support third-party login via OAuth) are all broken from a security POV?
[ Parent | on HN ]
Re:Show HN: A microservice that makes adding authentication ... by homakov on Monday February 20, 2017 @01:54PM (#13689862)
In one way or another. Most are vulnerable to bugs in standard (see sakurity.com/oauth) but every single one depends on central authority which is just stupid for auth.
[ Parent | on HN ]