Re:Ask HN: Developer abused “sign in with GitHub”?
by 9wzYQbTYsAIc on Friday December 09, 2022 @06:46AM
(#33920253)
> When you run a service on the web, it's not enough to protect yourself
Nothing but agreement there.
Can you identify a specific recommendation by the IETF or W3C that was ignored, in this case?
> And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa".
I had to look up that apparent reference to Harry Potter, but I disagree.
Educating your users about phishing risks, aka “caveat emptor” in this context, is explicitly a best practice for mitigating these kinds of security risks on the open web.
Nothing but agreement there.
Can you identify a specific recommendation by the IETF or W3C that was ignored, in this case?
> And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa".
I had to look up that apparent reference to Harry Potter, but I disagree.
Educating your users about phishing risks, aka “caveat emptor” in this context, is explicitly a best practice for mitigating these kinds of security risks on the open web.