TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Why Mastercard Doesn't Use OAuth 2.0

144 点作者 hitr将近 7 年前

11 条评论

alangpierce将近 7 年前
Related: here&#x27;s a write-up from one of the OAuth 2 authors on the problems he sees in OAuth 2 and why he thinks OAuth 1 is better:<p><a href="https:&#x2F;&#x2F;hueniverse.com&#x2F;oauth-2-0-and-the-road-to-hell-8eec45921529" rel="nofollow">https:&#x2F;&#x2F;hueniverse.com&#x2F;oauth-2-0-and-the-road-to-hell-8eec45...</a>
simonw将近 7 年前
It looks like they are concerned that OAuth 2.0 doesn&#x27;t include a cryptographic signature of the request body, as seen in OAuth 1.0.<p>My understanding is that OAuth 2.0 dropped that signature in favour of requiring TLS to protect against tampering. I&#x27;d be interested to know why Mastercard doesn&#x27;t consider this to be as good as the request body signatures in OAuth 1.0.
评论 #17482301 未加载
评论 #17482288 未加载
评论 #17482517 未加载
narsil将近 7 年前
I&#x27;m not sure I understand the concern with integrity of OAuth 2.0 payloads. Sending the request over HTTPS already ensures that the request is not tampered with, and also guards against replay attacks.
评论 #17483926 未加载
评论 #17482292 未加载
评论 #17482331 未加载
评论 #17482814 未加载
dwaite将近 7 年前
They did this to provide message-level integrity. OAuth 2 switched to Transport-level confidentiality&#x2F;Integrity.<p>It&#x27;s worth noting that message-level integrity was not a design goal of OAuth 1; it is was a consequence of being based on OpenID 1&#x2F;2, which were explicitly meant to run on HTTP without TLS so that they could be adopted by blogs. This was pre SNI, and pre cheap certs, so requiring HTTPS increased the hosting cost of a blog by an order of magnitude.<p>When the constraints changed such that requiring HTTPS was feasible, it greatly simplified OAuth. Some of these simplified proposals for OAuth became the input for OAuth 2 (where complexity was subsequently added back in the form of variants to support new use cases).<p>Relying on message level integrity in a protocol where such a thing was basically a side-effect of avoiding hosting costs would make me <i>very</i> nervous.<p>The clearest issue I can point to is that there is no response message integrity in MasterCard&#x27;s system - an intermediary can block requests to MasterCard and give back fraudulent responses (yes, of course that payment went through!). This throws a ton of application-dependent security considerations into the system.
gsich将近 7 年前
Using TLS makes it acceptable to send cleartext passwords. I don&#x27;t know why, seems lazy.<p>So, I understand why Mastercard doesn&#x27;t rely on that.
评论 #17482389 未加载
Noumenon72将近 7 年前
I think <a href="https:&#x2F;&#x2F;aaronparecki.com&#x2F;oauth-2-simplified&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aaronparecki.com&#x2F;oauth-2-simplified&#x2F;</a> explains that the cryptographic signature approach (if that&#x27;s what they mean by &quot;client secret&quot;) was discarded because mobile apps and single-page Javascript apps can&#x27;t maintain the confidentiality of a secret anyway.<p>So maybe OAuth 1.0 is only better for apps running on a server?
EGreg将近 7 年前
I once asked a related question on StackOverflow<p><a href="https:&#x2F;&#x2F;security.stackexchange.com&#x2F;questions&#x2F;161734&#x2F;why-does-oauth-and-oauth-2-have-access-tokens-at-all" rel="nofollow">https:&#x2F;&#x2F;security.stackexchange.com&#x2F;questions&#x2F;161734&#x2F;why-does...</a>
smooc将近 7 年前
Any app that takes security seriously will need to take a layered approach. So while Oauth 2, which is just a framework contrary to oauth 1.0a, seems to outsource its integrity protection to TLS this isnt enough: others have already pointed out that many companies hijack TLS at their edge proxies. Banks do this bu requirement of the regulator.<p>So you would need additional defenses against tampering such as OpenID Connect. In the banking apps that I have been working with we implemented additional symmetric encryption on top of the protocol (yes obfuscating the keys) and all other kinds of small things.<p>I’m glad mastercard does not rely solely on TLS.
评论 #17482617 未加载
woranl将近 7 年前
It’s unfortunate that Big companies are pushing for OAuth 2.0 and trying to blindsided developers as if OAuth 2.0 is an upgrade to OAuth 1.0a. It is not! OAuth 1.0a provides authenticity, integrity, and non-repudiation. Something that OAuth 2.0 cannot match.
starptech将近 7 年前
The problems reminds me of <a href="https:&#x2F;&#x2F;github.com&#x2F;hueniverse&#x2F;oz&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;hueniverse&#x2F;oz&#x2F;</a> it&#x27;s from one of the former oauth guys.
jacksmith21006将近 7 年前
Curious how many have moved from LDAP to using OAuth?<p>Would seem the future for enterprise will be OAuth.