[Wikitech-l] OAuth critique

2013-03-22 Thread Yuri Astrakhan
There was a discussion recently about OAuth, and I just saw this blog posthttp://insanecoding.blogspot.com/2013/03/oauth-great-way-to-cripple-your-api.html (posted on slashdothttp://tech.slashdot.org/story/13/03/22/1439235/a-truckload-of-oauth-issues-that-would-make-any-author-quit) with some

Re: [Wikitech-l] OAuth critique

2013-03-22 Thread Tyler Romeo
Most of those concerns are valid. Daniel Friesnen has managed to convince me that OAuth is absolutely horrible, and that we will probably have to make our own authentication framework. *-- * *Tyler Romeo* Stevens Institute of Technology, Class of 2015 Major in Computer Science

Re: [Wikitech-l] OAuth critique

2013-03-22 Thread Gerard Meijssen
Hoi, MAY I QUOTE YOU ??? Thanks, GerardM On 22 March 2013 17:11, Tyler Romeo tylerro...@gmail.com wrote: Most of those concerns are valid. Daniel Friesnen has managed to convince me that OAuth is absolutely horrible, and that we will probably have to make our own authentication

Re: [Wikitech-l] OAuth critique

2013-03-22 Thread Chris Steipp
I think the caricature of OAuth there should be taken with a grain of salt. The author talks about OAuth, but seems to be referring to OAuth 2 primarily, which is very different from OAuth 1. Also, the author says that the protocol was designed for authorizing website-to-website communication, but

Re: [Wikitech-l] OAuth critique

2013-03-22 Thread Brion Vibber
On Fri, Mar 22, 2013 at 8:59 AM, Yuri Astrakhan yastrak...@wikimedia.org wrote: There was a discussion recently about OAuth, and I just saw this blog posthttp://insanecoding.blogspot.com/2013/03/oauth-great-way-to-cripple-your-api.html (posted on

Re: [Wikitech-l] OAuth critique

2013-03-22 Thread Daniel Friesen
Oh yay, I actually convinced someone. This post is a little different than mine. A random spattering of high-level qualms with it. OAuth 2 not being a protocol. Flow issues (though a little debatable). And some stuff about enterprise that besides being irrelevant to us sounds like berating

Re: [Wikitech-l] OAuth critique

2013-03-22 Thread Matthew Flaschen
On 03/22/2013 12:48 PM, Chris Steipp wrote: I think the caricature of OAuth there should be taken with a grain of salt. The author talks about OAuth, but seems to be referring to OAuth 2 primarily, which is very different from OAuth 1. Also, the author says that the protocol was designed for