News for hackers. Stuff that matters.

A comment on Ask HN: Developer abused “sign in with GitHub”?. Parent comment

Re:Ask HN: Developer abused “sign in with GitHub”? by vintermann on Friday December 09, 2022 @06:34AM (#33920197)
When you run a service on the web, it's not enough to protect yourself. You must protect your users to the best of your ability. Threats against your users must be part of your threat model.

If not, you won't keep them. They will leave. And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa".

[ Parent | on HN ]
Re:Ask HN: Developer abused “sign in with GitHub”? by 9wzYQbTYsAIc on Friday December 09, 2022 @06:46AM (#33920253)
> When you run a service on the web, it's not enough to protect yourself

Nothing but agreement there.

Can you identify a specific recommendation by the IETF or W3C that was ignored, in this case?

> And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa".

I had to look up that apparent reference to Harry Potter, but I disagree.

Educating your users about phishing risks, aka “caveat emptor” in this context, is explicitly a best practice for mitigating these kinds of security risks on the open web.

[ Parent | on HN ]