Recent searches

No recent searches

Search options

Only available when logged in.
mastodon.world is one of the many independent Mastodon servers you can use to participate in the fediverse.
Generic Mastodon server for anyone to use.

Administered by:

Server stats:

8.1K
active users

mastodon.world: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.0

#authorization

3 posts3 participants0 posts today
Continued thread
Serge from Babka

Another approach would be if Alice could generate multiple Passkeys and hand them out to individuals she trusts, and then retaining the ability to revoke them. Sadly many sites don't yet support Passkeys, and this model still lets someone like Mal revoke Alice's access, so that's not great.

Bitwarden has a feature whereby Alice can share a password with Eve but not let her see it or export it. This could work pretty well, except that if the site requires 2FA from a SMS text message (vs TOTP or a token) or if Eve has the knowhow to intercept the password.

I still think that what we ultimately want is attenuated scopes because then we can track all actions by the delegated party.

I do wonder if this need is niche or if the current solution of "good faith password sharing" works well enough often enough that it's not risen to the level of concern for developers.

2/2

#Authentication#Authorization#InfoSec
*
Serge from Babka

I've been thinking about delegated authority on websites lately.

It would be convenient if I could delegate certain functions to people, for example allowing someone like my accountant to have access to some of my financial records.

Some organizations make this easy, allowing me to have multiple accounts.

Other services don't offer this, nor do they offer any kind of OAuth type of delegated authorization or capabilities model.

I've been thinking about ways around this.

One very wacky way would be if Alice could have a a "special browser" that would tie into some service she runs. Bob would log in with his credentials and then behind the scenes the application logs in as Alice.

This would be very complicated to implement though.

1/

#Authentication#Authorization#InfoSec
*
|7eter l-|. l3oling 🧰

Ann: Launched Open Collective for Ruby OAuth gems (oauth, oauth2, & others)

I've been the primary maintainer of OAuth tools in Ruby since 2017. In this move toward supporting myself with open source work I need your help!
opencollective.com/ruby-oauth #Ruby #OAuth #Authorization #Security #OIDC

opencollective.comThe Ruby OAuth Collective - Open CollectiveDevelop and maintain OAuth 1.0, 2.0, and 2.1 client libraries for Ruby, including oauth, oauth2, oauth-tty
Habr

Путеводитель по Ktor JWT auth на стороне сервера

Документация Ktor по server-jwt неполна. Если необходимо сделать что-то за рамками «Hello world», придется лезть в исходники и городить костыли. Какой-то консистентности и предсказуемости ждать не стоит, возможно, не обошлось без заговорщиков . Статья покроет необходимую базу для работы с JWT и убережет от множества подводных камней.

habr.com/ru/articles/921076/

ХабрПутеводитель по Ktor JWT auth на стороне сервераДокументация Ktor по server-jwt неполна. Если необходимо сделать что-то за рамками «Hello world», придется лезть в исходники и городить костыли. Какой-то консистентности и предсказуемости ждать не...
#ktor#backend#kotlin
*
beSpacific

Trump’s effort, combined thrust of his other #constitutional transgressions, uniquely dangerous. No indication he gave any thought to seeking #congressional #authorization. As self-concerned, immature a commander-in-chief as country has had, he likely acted, as always, out of crass self-interest. #Israel surprisingly successful #bombardment of last week put him in position to be a winner by finishing off the job—very possibly the only thing that was in his #lizard #brain. harrylitman.substack.com/p/tru

Talking Feds Substack · Trump’s Strike on Iran and the Constitution — and Iran’s RetaliationBy Harry Litman
*
beSpacific

#Trump faces #bipartisan blowback in #Congress on #Iran strikes Why it matters: While most #congressional #Republicans some pro-Israel #Democrats are praising President Trump's strikes on #Iranian #nuclear facilities, pockets of #opposition are already emerging over whether he needed congressional #authorization for such a #provocative use of #military #force. Yes, he did need Congressional #authorization..why is there even a question. #warpowers #foreign #policy #retaliation #democracy #war

TrendingLive feeds
About