Eran Hammer

http://hueniverse.com/ is a great follow up post which provides a lot of extra information / background / scope

Here is my list of solo developer blogs. Usually they are on topic. This does not include personal blogs I follow that happen to be developers. @mdo (Bootstrop) - http://markdotto.com/ Keith Cirkel - https://www.keithcirkel.co.uk/ Coding – Corbin's Treehouse - https://www.corbinstreehouse.com/blog Aaditya Purani – Ethical Hacker - https://aadityapurani.com/ Ben Balter - http://ben.balter.com/ fulldecent - https://privacylog.blogspot.com Orange - http://blog.orange.tw/ Cocoa with Love - http://www.cocoawithlove.com/ Mark Otto - http://markdotto.com/ Moxie Marlinspike's Blog - http://www.thoughtcrime.org/blog/ hueniverse - http://hueniverse.com/

This seems relevant...[1] I've implemented OAuth once or twice, but it's painful, and I've been hesitant to recommend it as a login or security method both because it's a pain, and because of this article's concerns. [1] https://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/

while you're technically right, did the implementers knew and followed the spec as well? now THAT's the real problem. most of them did, but there are quite some gaps. then you extensions and shit to complicate matter further: http://hueniverse.com/2012/07/30/on-leaving-oauth/ I like OpenID efforts to making a OAuth 2.0 subset that works and is authoritative, but to be honest implementing OAuth dialect isn't that much of an issue. now, having a single consistent user id across services beyond their email, that's an interesting problem to solve. but for everything OAuth one can find out libraries in many languages.

Good point. > At the end of the day, there's money to be made in the technology somehow. But reading Scott Hammond's PR again I have the impression that he oppose the open-governance model to Enterprise users' needs. I might be operating under the wrong set of assumptions but to me, an open-governance model is the best way to make the smartest decisions possible for the language's future and accommodates everyone needs as much as possible. Slightly off-topic but Eran Hammer's post describe some of the conflicts between Enterprise needs and the Web world's in the context of OAuth 2.0 : http://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/

Interesting editorial decision by Jeremy to submit this today and "The Fallacy of Tiny Modules" a few weeks ago. I recommend reading both. http://hueniverse.com/2014/05/30/the-fallacy-of-tiny-modules/ https://news.ycombinator.com/item?id=7822383

to be honest I am currently lost on the state of oauth in python, has sth changed since this post http://pydanny.com/the-sorry-state-of-python-oauth-providers.html? as OP is a client lib, could somebody with practical experience tell me what's the current best library for setting up an oauth provider? bonus question: should I bother with 2.0 or stick to 1.0 (3rd party apps and mobile) http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/ ?

So is the following critique out of date? http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/

> I wonder why someone hasn't already transitioned Twitter to a publish-subscribe architecture internally, and used a bunch of queues to buffer the impact of load spikes ( a slow tweet is not the same as a dropped tweet! ). c.f. Starling : http://rubyforge.org/projects/starling/ As others have pointed out, it's not the messaging that's hard, it's the ad-hoc services-- friends-of-friends timelines, keyword search/subscriptions, etc. that are hard to scale and are what is bringing twitter down: http://www.hueniverse.com/hueniverse/2008/03/on-scaling-a-mi.html Which, to jzawodn's point, is actually really similar to what FriendFeed is doing under the hood, and doing it well.

Great post. The original TechCrunch article is another instance of talking about how things fail (miserably), rather than talking about how things can be improved to not fail. Poor journalism. The real issues about Twitters scalability are best covered in a blog post @ http://www.hueniverse.com/hueniverse/2008/03/on-scaling-a-mi.html

I am currently an IAM engineer and can I just throw out there how much I hate OAuth/OIDC, I work at a large org and have to integrate with dozens of different vendors and applications and not a single one has the same way of doing OAuth because to quote the spec, wait it isn't a spec it is a "framework" we have to remember that, under interoperability it says > OAuth 2.0 provides a rich authorization framework with well-defined security properties. However, as a rich and highly extensible framework with many optional components, on its own, this specification is likely to produce a wide range of non-interoperable implementations. Don't get me wrong, OAuth is still better than WS-Fed and what we had before but we really need to come up with a real standard and spec for authentication, because OAuth/OIDC is a joke. It isn't just me either that thinks this one of the authors of the OAuth spec said as much[1] Can anyone tell me what their experience with OAuth has been, or have they been able to get it to work across multiple different systems. I would love to believe it is just my org, but it seems like the entire identity space is a clusterfck. [1] https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529

I went on a similar journey but for OpenID Connect. While the spec is fantastic https://openid.net/specs/openid-connect-core-1_0.html#Overview, I found the same thing to be true - very little explanation of why. For example, it's very clear how each flow works and therefore how to implement, but not clear why there are so many of them. While researching and building my own implementation I eventually ran into IdentityServer3 https://identityserver.github.io/Documentation/ which had a nice intro video explaining things clearly. I also quit building my own at that point, since their offering is very well done and using the same stack as the rest of our software. I wouldn't say the docs are a good resource, but they helped a bit. There's also a version 4 now, though the documentation looks about the same. Also not a good resource, but acceptable: Pluralsight. There is one straight up OAuth course to go over all the basics and then quite a few language/framework specific ones, e.g. how to implement OAuth in Node/ASP.NET/etc. The OAuth course was dry but had some decent information - but I did quit halfway through it because of IdentityServer, so take that with a grain of salt. And yes, it sure does feel more complicated than it has any right to be. There's a good read here https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529?gi=… by the once-lead-author. I really do recommend checking out IdentityServer4 though, unless you're implementing this…

An argument I've heard against TLS is that it's easy for clients to get wrong. In some cases, client code needs to directly check that the certificate matches the intended domain, and forgetting to do so makes TLS worthless because an attacker can just use any valid certificate. In other cases, certificate checking runs into some problem, and an inexperienced developer finds a "solution" on StackOverflow to just disable certificate checking, which, again, makes TLS worthless. In other cases, a client might make a valid TLS request to the wrong server (either by mistake or due to some other attack). With OAuth 2, any of these problems will leak your bearer token, meaning than an attacker can act as you until the token expires. With OAuth 1, you're typically going over TLS anyway, but even if an attacker knows the contents of all requests, they won't be able to act as you because they still won't be able to sign any future requests. Edit: I just dug up the blog post I've read that describes most of the points I made above: https://hueniverse.com/oauth-bearer-tokens-are-a-terrible-idea-1a300fd…

This is a collection of the author's favourite technologies/gripes, not a useful proposal. A large number of errors can be found by considering that it'll have to talk SMTP on the back end. I'll only point to some "highlights". OAuth isn't nearly secure enough (http://hueniverse.com/2009/04/explaining-the-oauth-session-fixation-at… for your e-mail (which, don't forget, gives access to everything via password resets). Let's just ignore the part about third-party access. Encoding everything as UTF-8 is nice, but breaks the first time some idiot mail client puts Shift-JIS encoded Japanese in the Subject: field. Without any charset marker, obviously. (This goes right back to the "where does the mail come from?" issue.) IMAP has a THREAD extension (solving #4), a SEARCH extension (solving #9 and parts of others), and all sensible servers support IDLE (http://en.wikipedia.org/wiki/IMAP_IDLE). It also supports downloading MIME parts separately, solving the part of #7 that can actually be solved (again, you'll have to accept mail.)

That's when committees and standards bodies work well. When they don't, you get OAUTH2. https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529

for OAuth 2.0 at least, the creator disowned it because the process spun out of control https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529

I'd have preferred improvements to OAuth, see: https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529 and https://vimeo.com/52882780

A Google search returns 3 parts: Part 1: https://hueniverse.com/beginners-guide-to-oauth-part-i-overview-e164ab… Part 2: https://hueniverse.com/beginners-guide-to-oauth-part-ii-protocol-workf… Part 3: https://hueniverse.com/beginners-guide-to-oauth-part-iii-security-arch… However, I would like to confirm there isn't more

Why would anyone put mission-critical features like login in the hands of a 3rd party in the first place? Not to mention that OAUTH itself is crap (https://hueniverse.com/oauth-2-0-and-the-road-to-hell-8eec45921529), and should be avoided.

Not according to one of its main artisan. https://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/

Should we use Hawk + Oz[1]? [1] https://hueniverse.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an…

Is OAuth2 back in the good graces of the dev community? I thought one of its creators considered it a dead standard? https://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/ (Genuinely asking because I've been thinking I might use a centralized auth store in a project recently and I wondered what the state of the art was.)

ok, I finally found it. Note that it's still from 2012 and we've moved along from that dispute. * http://www.thread-safe.com/2012/07/the-oauth-2-sky-is-not-falling.html * https://hueniverse.com/2012/07/30/on-leaving-oauth/

> I don't think anyone said he was "evil" or "dickish" Dude, the article literally calls him both of those things and links to another article that is entirely about what a dick the author thinks he is.[0] [0] http://hueniverse.com/2014/07/30/open-source-dickishness/

People spending their free time writing open source software should write it in whatever they want. There is no way anyone should be forced to comply with any standard when they are freely sharing their code. This article perfectly reflects my thoughts when it comes to asking open source authors to do anything: http://hueniverse.com/2016/01/26/how-to-use-open-source-and-shut-the-f…

For those who are interested, Eran Hammer released an OAuth2 replacement in September: "Iron is a simple way to take a JavaScript object and turn it into a verifiable encoded blob. Hawk is a client-server authentication protocol providing a rich set of features for a wide range of security needs. Oz combines Iron and Hawk into an authorization solution. Together these three modules provide a comprehensive and powerful solution." Read more here: http://hueniverse.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an-…

I'm curious what people's opinion of Oz is as it was created by the "Fuck OAuth" guy aka Eran Hammer that the article refers to. http://hueniverse.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an-…

Similar read[0] with an actual proposal replacement for OAuth at the end. Thoughts? [0] http://hueniverse.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an-…

This was predicted http://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/ Oauth 2.0 is so much of a flexible framework it almost boils down to "roll your own crypto with very complex tools and a lot of moving parts" I am gonna watch the world burn safely eating my popcorn with my old fashions AAA system (radius, LDAP, ssh..) expecting more vulnerabilities to be uncovered and waiting for employers and architects to require my now valuable knowledge. Mouhahahahahahha

Mostly agree with you, but minor nit: The server doesn't need to know anything reversible about the password. A message digest is enough. And your final paragraph is the reason I posted my original comment in the first place. Don't design a auth/security protocol when you design a mail protocol. Delegate to OAuth, move on. (Then again... debate rages there, too[1]. Auth is not fun(tm)) [1] http://hueniverse.com/2012/07/26/oauth-2-0-and-the-road-to-hell/