Hacker News Reader

Comment by firloop | Hacker News Reader

Link to the infringing source, for the curious:

https://github.com/ncw/rclone/blob/a9d29c22645c9b5d2ab938ebb...

> My guess is that the software will probably just require users to get their own secrets as part of the initial configuration.

Amazon has stopped giving out any more API keys (https://developer.amazon.com/amazon-drive). So I guess that isn't an option unless Amazon opens it up again...

See also, the de-obfuscation wrapper [1], decryption implementation [2], and the key [3].

[1] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664... [2] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664... [3] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664...

So is this basically sharing the same API key? Wouldn't that make using this insecure, as you'd be seeing the same data as other rclone users?

Not if the source data is encrypted using a local key. What may be possible is deleting other user's data as I believe it'd all be authorized with the same API key.

In OAuth, you have basically two tokens: One for the "software"/"third party service provider", one for the account itself.

So for example, if you want to use SomeMagicTweetTool to send tweets, they use their token to prove it's them, and you grant them a special token for your account.

Someone who has their token can pretend to be them, use their quota if there is per-software/per-provider quota, but cannot access your account unless you gave them a token for your account.

Reply on news.ycombinator.com