Hacker News Reader

Comment by qwerty456127 | Hacker News Reader

> Back in pre-2007, there was no way for developers to build apps that needed to securely access user data in another service.

I understand there are cases and people when this is needed but as for me I bloody never want anybody to access my "user data in another service" and that's why I strongly prefer plain old email sign-up: in many cases if you sign-up with your google account the service will also request your contacts list, your personal details and everything and I never want to share these.

Nevertheless the single sign-in feature OAuth/OpenID provide seems very convenient (unless implemented improperly when the service would take your OpenID and still ask you to set a password, a login name and/or e-mail address) so I still use it for some services.

View on HN

Just think about companies like Mint who scrape your banking and financial information using your creds. Not sure if Mint has changed this or not (or if the banks opened an API) but at one point it was the case.

In the enterprise space these solutions help a lot. Especially with the rise of enterprise cloud software solutions like Salesforce, Workday, and ServiceNow.

They still do that for 99% of the banks, since most banks don't support OAuth/OIDC yet :(

Chase recently switched over to OIDC which was pretty neat, but for most banks, it is an absolute nightmare.

There are several initiatives (such as Open Banking) which are mandating certain levels of access.

When I read about that, I lost my mind. People who give their banking creds to someone who isn't their bank are insane.

That's one of the nicer things about these flows: you can have scoped data that is allowed, and nothing more.

The ideal use case here is for banks, and services that store a lot of sensitive data. If you want to pull your data from your bank into a service like Mint, you would ideally like for Mint to only get read access to your transactions, nothing else: no ability to send $$$, etc.

> That's one of the nicer things about these flows: you can have scoped data that is allowed, and nothing more.

IIRC the user is rarely given a choice, same as when you install an Android app from the Google Play store - they just tell you the app demands to access this and that an give you an Ok/Cancel choice instead of options to allow or disallow access to every particular element in the app's demands list and still install it regardless to what does the app author want (I don't mind if some features won't work then). IMHO this is seriously wrong.

> as for me I bloody never want anybody to access my "user data in another service."

You're forgetting that local applications fall into this category too: email, calendaring, storage, messaging, remote access, music/movie streaming, VPN, Twitter, code repositories, container registries, cloud cli tools, chat, chatbots, database access, directory access.

Wouldn't it be nice if you never had to click "Save my password" or use a service account ever again?

Reply on news.ycombinator.com