[icebraining]

Why does Gitlab have to trust anyone? It's the user that has to trust stravros.io not to tell Gitlab that other people are authorized.

It's no different than a regular email/password (with password recovery): if I register with [e-mail], then that email server becomes empowered to give access to the Gitlab account to anyone it wants. But that's not Gitlab's problem.

See also OpenID.

[StavrosK]

Exactly, and OpenID connect adds an authentication layer over OAuth2 for this exact purpose. If we manage to build that future, it will be very useful and quite exciting, at least to me. There won't be compromised passwords any longer, just the one password you can easily change.

[lucaspiller]

You are ten years too late. The original OpenID did exactly this, and quite a few sites (especially tech focussed sites) let you sign in with it. Except then along came Google and Facebook with their proprietary login systems, and everyone jumped ship to those as they offered access to profiles rather than just a domain and possibly email address.

[dboreham]

We first worked in this problem at Netscape just after the AOL acquisition in 1998. It turns out to be impossible because: show me the money. Something we figured out within a few weeks back then.

[cat199]

Which is precisely why DNS and SMTP have failed miserably.

[garfij]

Please elaborate on how DNS has failed? It seems to me that everyone uses DNS all the time and is an essential component of the Internet as we know it, but you and I may have differing notions of failure.

[mike-cardwell]

I assume he was being sarcastic

[jamespo]

Anyone would think the internet has become more closed in recent years or something

[StavrosK]

> You are ten years too late.

As in, what I want has been working for ten years?

I'm obviously not late at all, since websites still won't let me delegate my auth.

[chowells]

The few that allowed OpenID 10 years ago did let you delegate your auth. OAuth and OpenID Connect killed that.

[StavrosK]

I don't care that some technology exists. I want it to be widespread. OpenID had huge usability problems.

[tinus_hn]

Not just the data but also using Facebook or Google accounts means your users are much more likely to be real people instead of spam bots.