Re:Ask HN: Developer abused “sign in with GitHub”?
by osigurdson on Friday December 09, 2022 @09:17AM
(#33921424)
It is interesting though, most people use it just to avoid creating a new username/password on a random site. Usually there is no intention to grant access to any data maintained on the IDP's site. I know the concept of granting such access is the whole point of OAuth but honestly seems like a rarely needed use case.
[ Parent
| on HN ]
Re:Ask HN: Developer abused “sign in with GitHub”?
by anon84873628 on Friday December 09, 2022 @09:53AM
(#33921800)
The website (oauth client) has to tell the IdP (oauth provider) what level of access they want to have on the user's behalf. OIDC is an extension of oauth that focuses on the basic identity aspects. (It basically just standardizes the user info and how to ask for it).
So an app could request only the non-data-access OIDC scope, or an IdP could enforce that it only allows apps the OIDC info.
On top of that is the user consent. What has been pointed out in threads here is that the IdPs are making the UX for basic OIDC consent too similar to the UX for consenting to privileged data access.
And of course if an oauth token is being abused, the IdP should ban the client app first, not the user...
Re:Ask HN: Developer abused “sign in with GitHub”?
by osigurdson on Friday December 09, 2022 @10:12AM
(#33922053)
Yes, I know how it works. My assertion is it really should not work this way by default. Providing identity (i.e. email address) to a random website is much different from providing them with access to sensitive data (often subtly shown in the signup dialog).
It is good to take a step back from the tech and think about it from the user's perspective.