News for hackers. Stuff that matters.

A comment on Show HN: iPod.js – An online iPod that connects to Spotify and Apple Music.

Re:Show HN: iPod.js – An online iPod that connects to Spotif... by sirfrankiecrisp on Wednesday June 23, 2021 @03:31PM (#27608963)
Maybe a bit of a dumb question, but how can one be sure that this doesn't steal my credentials when logging in with spotify? It's open source, so I guess someone would probably have figured it out if it did by now, but is there a way to be sure or is it even possible?
[ Parent | on HN ]
Re:Show HN: iPod.js – An online iPod that connects to Spotif... by prezjordan on Wednesday June 23, 2021 @04:56PM (#27610237)
Not a dumb question, very much appreciate you keeping an eye out for your password security. It uses an OAuth flow so you're actually entering your credentials on accounts.spotify.com (Spotify-owned) and then Spotify gives this developer a token (rather than a username+password) to access your data (usually a very limited subset of data outlined on the login page).
[ Parent | on HN ]
Re:Show HN: iPod.js – An online iPod that connects to Spotif... by sirfrankiecrisp on Monday June 28, 2021 @09:57AM (#27662021)
Oh I see, makes sense! Thanks for the answer - very much appreciated!
[ Parent | on HN ]
Re:Show HN: iPod.js – An online iPod that connects to Spotif... by ramenmeal on Wednesday June 23, 2021 @05:16PM (#27610486)
any idea why it uses ngrok when I go to the sign in flow? Chrome is saying the connection is insecure.
[ Parent | on HN ]
Re:Show HN: iPod.js – An online iPod that connects to Spotif... by baetylus on Wednesday June 23, 2021 @10:02PM (#27613026)
he's probably just using ngrok as a server and the SSL cert on that ngrok process probs isn't verified by a CA. just a guess tho
[ Parent | on HN ]
Re:Show HN: iPod.js – An online iPod that connects to Spotif... by ike0790 on Wednesday June 23, 2021 @03:34PM (#27608995)
how can you be sure that any web site asking for google authentication doesn't "steal" your goolge data?

The reason is because of a protocol called Oath2.

[ Parent | on HN ]
Re:Show HN: iPod.js – An online iPod that connects to Spotif... by sirfrankiecrisp on Wednesday June 23, 2021 @03:38PM (#27609048)
Nice, thanks! I have heared of OAuth2 before, but didn't know what it was for... Now I know:)
[ Parent | on HN ]