{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/127","repository_url":"https://api.github.com/repos/strongloop/loopback-component-passport","labels_url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/127/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/127/comments","events_url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/127/events","html_url":"https://github.com/strongloop/loopback-component-passport/issues/127","id":141031459,"number":127,"title":"Where does account security come from with social login?","user":{"login":"jubbens","id":1747256,"avatar_url":"https://avatars.githubusercontent.com/u/1747256?v=3","gravatar_id":"","url":"https://api.github.com/users/jubbens","html_url":"https://github.com/jubbens","followers_url":"https://api.github.com/users/jubbens/followers","following_url":"https://api.github.com/users/jubbens/following{/other_user}","gists_url":"https://api.github.com/users/jubbens/gists{/gist_id}","starred_url":"https://api.github.com/users/jubbens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jubbens/subscriptions","organizations_url":"https://api.github.com/users/jubbens/orgs","repos_url":"https://api.github.com/users/jubbens/repos","events_url":"https://api.github.com/users/jubbens/events{/privacy}","received_events_url":"https://api.github.com/users/jubbens/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback-component-passport/labels/triage","name":"triage","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"jannyHou","id":12554153,"avatar_url":"https://avatars.githubusercontent.com/u/12554153?v=3","gravatar_id":"","url":"https://api.github.com/users/jannyHou","html_url":"https://github.com/jannyHou","followers_url":"https://api.github.com/users/jannyHou/followers","following_url":"https://api.github.com/users/jannyHou/following{/other_user}","gists_url":"https://api.github.com/users/jannyHou/gists{/gist_id}","starred_url":"https://api.github.com/users/jannyHou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jannyHou/subscriptions","organizations_url":"https://api.github.com/users/jannyHou/orgs","repos_url":"https://api.github.com/users/jannyHou/repos","events_url":"https://api.github.com/users/jannyHou/events{/privacy}","received_events_url":"https://api.github.com/users/jannyHou/received_events","type":"User","site_admin":false},"assignees":[{"login":"jannyHou","id":12554153,"avatar_url":"https://avatars.githubusercontent.com/u/12554153?v=3","gravatar_id":"","url":"https://api.github.com/users/jannyHou","html_url":"https://github.com/jannyHou","followers_url":"https://api.github.com/users/jannyHou/followers","following_url":"https://api.github.com/users/jannyHou/following{/other_user}","gists_url":"https://api.github.com/users/jannyHou/gists{/gist_id}","starred_url":"https://api.github.com/users/jannyHou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jannyHou/subscriptions","organizations_url":"https://api.github.com/users/jannyHou/orgs","repos_url":"https://api.github.com/users/jannyHou/repos","events_url":"https://api.github.com/users/jannyHou/events{/privacy}","received_events_url":"https://api.github.com/users/jannyHou/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2016-03-15T16:41:29Z","updated_at":"2016-06-28T18:44:39Z","closed_at":null,"body":"I have seen other people indicate that social logins should be authenticated using `UserIdentity.login()`. I see that I can allow people to pass in an `id` and an `accessToken` to that function and if a local `User` does not already exist for this social login, one will be created. Great!\r\n\r\nHowever, it seems like now anybody who knows that `id` can use it to perform a social login with that account and gain access to that local user. They don't even have to pass in the same `accessToken` in order for `UserIdentity.login()` to grant them access to that local user. This seems like a huge security issue to me, especially since that `id` is not hashed in the database. \r\n\r\nAm I going about this wrong, or does loopback-component-passport expose this security hole by design?"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/comments/229144162","html_url":"https://github.com/strongloop/loopback-component-passport/issues/127#issuecomment-229144162","issue_url":"https://api.github.com/repos/strongloop/loopback-component-passport/issues/127","id":229144162,"user":{"login":"BerkeleyTrue","id":6775919,"avatar_url":"https://avatars.githubusercontent.com/u/6775919?v=3","gravatar_id":"","url":"https://api.github.com/users/BerkeleyTrue","html_url":"https://github.com/BerkeleyTrue","followers_url":"https://api.github.com/users/BerkeleyTrue/followers","following_url":"https://api.github.com/users/BerkeleyTrue/following{/other_user}","gists_url":"https://api.github.com/users/BerkeleyTrue/gists{/gist_id}","starred_url":"https://api.github.com/users/BerkeleyTrue/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BerkeleyTrue/subscriptions","organizations_url":"https://api.github.com/users/BerkeleyTrue/orgs","repos_url":"https://api.github.com/users/BerkeleyTrue/repos","events_url":"https://api.github.com/users/BerkeleyTrue/events{/privacy}","received_events_url":"https://api.github.com/users/BerkeleyTrue/received_events","type":"User","site_admin":false},"created_at":"2016-06-28T18:44:39Z","updated_at":"2016-06-28T18:44:39Z","body":"For reference, here are the relevant files that we use at FreeCodeCamp to make this work:\r\n\r\nhttps://github.com/FreeCodeCamp/FreeCodeCamp/blob/staging/server/component-passport.js\r\nhttps://github.com/FreeCodeCamp/FreeCodeCamp/blob/staging/server/passport-providers.js\r\n\r\nAnd how we load it on server boot:\r\n\r\nhttps://github.com/FreeCodeCamp/FreeCodeCamp/blob/staging/server/server.js#L10\r\nhttps://github.com/FreeCodeCamp/FreeCodeCamp/blob/staging/server/server.js#L28\r\n\r\nWe also overwrite the login methods elsewhere but their signatures remain the same. So for the purposes of this issue they are irrelevant.\r\n\r\nFor anyone trying to use this module the first two links are what you need to get running.\r\n\r\nI would also suggest to anyone starting a project that they stick to email and only ONE third party O-Auth provider or just email alone. We originally started with 4 and had/still have a huge headache when users forget which social login they used, create a new account without realizing it, and then they believe all their user data has been lost. \r\n\r\nWe have since removed the ability to create new accounts with all but one social O-Auth and will eventual remove the ability to login with the old ones as well."}}
{"actor":{"display_login":"BerkeleyTrue"}}