News for hackers. Stuff that matters.

A comment on Sign in with Matrix. Parent comment

Re:Sign in with Matrix by heftig on Tuesday November 16, 2021 @09:21AM (#29240808)
The website does get your credentials. To be fair, this is how password login with any of the web clients works as well. Which makes it hazardous to use clients not hosted by the homeserver or a trusted third party.

However, if the homeserver is using OIDC, the user credentials are handled entirely by the external OIDC provider and the client doesn't get them. But then you should be using OIDC directly and not "Sign in with Matrix."

[ Parent | on HN ]
Re:Sign in with Matrix by driminicus on Tuesday November 16, 2021 @09:34AM (#29240955)
We are actually working on fixing the password sending issue, see for instance https://github.com/matrix-org/matrix-doc/pull/3262

Of course, untrusted clients can do all kinds of evil things after having authenticated. (And also clients still need the plaintext password at least client-side no matter what we do)

[ Parent | on HN ]
Re:Sign in with Matrix by detaro on Tuesday November 16, 2021 @09:47AM (#29241092)
> (And also clients still need the plaintext password at least client-side no matter what we do)

Are matrix devs seriously not aware of what OAuth is and does? That is ... concerning.

[ Parent | on HN ]
Re:Sign in with Matrix by driminicus on Tuesday November 16, 2021 @02:26PM (#29245247)
Matrix does actually support OAuth (in fact, the mozilla.org matrix server can only be logged in to through OAuth)
[ Parent | on HN ]