Hacker News Reader

Comment by godzillabrennus | Hacker News Reader

DropBox seems to have decided that the only way for them to grow is to turn their data sync platform into a collaborative platform. Makes a whole lot of sense to steal contacts from all your users.

FYI - never use oauth to log into anything you care about.

View on HN

I am not so sure if oauth is to blame alone. I mean, it is a technology that lets you control what you want to share. However, engaging in business with a partner who decides to change the rules, is something I see a lot more critical.

So maybe the lesson should sound more like

- 'Don't use Dropbox for anything you care about' or

- 'Don't do business with large corporations for anything you care about'

To clarify, I am not saying it to protect oauth (in its current state I am not a particular fan of it), but to show, that the technology doesn't change by itself and that someone decided to change it. So the company who decided to execute this unethical change should take its share of the blame too.

Isnt the point here that you don't have control? Seems like you need to allow contact access to use google login at all.

There is no fine grained control to permissions.

That's not oauth, that's just the granularity the auth provider has decided to expose in its permissions system, and the granularity Dropbox have opted to request.

That's oauth in the sense that if you login with your own login/pass, this will never be something they can force on you. I never use oauth, always login/pass, and don't have to care about what permissions they ask me, it's easy, they have absolutely zero access to my gmail/facebook/twitter whatever.

Sadly, you can't have a product that does one thing and does it well when you have to show never-ending growth to investors :(

Even more sadly that same thing seems to be true of FOSS applications because people think an application you aren't constantly updating and adding features to is "abandoned".

Software isn't allowed to just be done anymore.

Well, fortunately, there are exceptions. Case in point being XFCE. It has remained the same for years.

However, your point still stands, because exceptions are just that, exceptions.

> FYI - never use oauth to log into anything you care about.

Interesting remark. I'm not objecting but it's interesting that this goes against what can one read here very often from people who comment on new products, which goes like this: "if you offered oauth sign up, I'd sign up but won't bother with creating an account". Just an observation.

I'm the opposite. 'only Google and Facebook Auth ? Can't create account ? Bye.'

It vastly increases the tracking that FB and Google can do. Bad idea. Also, knowing Google, perhaps they one day decide to discount the oauth login feature?

not discount, discontinue of course

do you mean OpenID? I guess oauth is OK for signups if the tokens were expiring. But usually you naively give the credentials to a new startup, only to find out they abuse them months later.

Can you elaborate on that? How can they abuse it? Your oauth provider will show you which permissions the app is requesting when you grant them access. What kind of abuse have you seen?

Is there an oauth provider that offers what mobiles have started to do with permissions, where "deny" just gives empty data to to the requesting application instead of actually rejecting the claim?

It'd be nice to see Google offer something like that.

Facebook does this with theirs for access to a user’s Pages. Just an empty array, which isn’t unusual for normal users.

Makes it tough for third-party devs to debug a legit “I am not seeing Page X as an option” though.

> FYI - never use oauth to log into anything you care about.

I definitely agree with this. While it's true that Google, Microsoft, Facebook, and Apple are probably better at securing accounts than most other companies, there's always the possibility that they can be compromised.

Another problem is that if your oauth provider decides to close your account for whatever reason, it may be difficult or impossible to unlink everything from it.

Not only do I create real accounts for any service I want to use, I divide them up among multiple separate email accounts, so that if one account is compromised, I limit the associated services that are vulnerable as a result.

My Spotify is broken since I deleted my Facebook. I can't even change the email in my profile.

Contact Spotify support. Had a similar problem where I had a leftover Facebook-Spotify account after delinking that blocked my normal account from changing my email. Spotify support was quick to help me.

> FYI - never use oauth to log into anything you care about.

Or, "Then create a password and revoke oauth permissions from the provider"

These days all browsers offer to generate and save a syncable password for you and fill in the email, so it's almost as easy to make a normal account as it is to use OAuth. It feels like OAuth/SSO is a tool for a different, less user-friendly era.

Not following. What's wrong with oauth?

When Google's AI (=RNG) decides to terminate your account (maybe you typed a few too many comments on YouTube, this has happened to people), you'll lose every service for which you used Google to sign in with.

Also, the usual tracking stuff.

In addition, you are limited to the few providers which are being supported by the platform. So you can't simply create your own authentication provider as it was possible with OpenID.

Don't websites usually create an association between a local user (in their DB) and an oauth2 account, linked by the email address? And then all your data is linked to the local DB user. I guess it's a bigger threat if you don't use your own domain for email.

EDIT: I'm talking about sites that also have their own local user db of course, so you could just do a password reset.

Reply on news.ycombinator.com