{"action":"created","issue":{"url":"https://api.github.com/repos/portier/portier.github.io/issues/34","repository_url":"https://api.github.com/repos/portier/portier.github.io","labels_url":"https://api.github.com/repos/portier/portier.github.io/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/portier/portier.github.io/issues/34/comments","events_url":"https://api.github.com/repos/portier/portier.github.io/issues/34/events","html_url":"https://github.com/portier/portier.github.io/issues/34","id":327309670,"node_id":"MDU6SXNzdWUzMjczMDk2NzA=","number":34,"title":"[query] Can my broker impersonate me?","user":{"login":"kwill","id":229415,"node_id":"MDQ6VXNlcjIyOTQxNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/229415?v=4","gravatar_id":"","url":"https://api.github.com/users/kwill","html_url":"https://github.com/kwill","followers_url":"https://api.github.com/users/kwill/followers","following_url":"https://api.github.com/users/kwill/following{/other_user}","gists_url":"https://api.github.com/users/kwill/gists{/gist_id}","starred_url":"https://api.github.com/users/kwill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kwill/subscriptions","organizations_url":"https://api.github.com/users/kwill/orgs","repos_url":"https://api.github.com/users/kwill/repos","events_url":"https://api.github.com/users/kwill/events{/privacy}","received_events_url":"https://api.github.com/users/kwill/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-05-29T12:59:22Z","updated_at":"2018-06-04T16:06:21Z","closed_at":null,"author_association":"NONE","body":"The idea behind Portier is that I can log into service A using a token granted by my broker. What stops the broker from gaining access to my account on service A? Surely a bad actor with sysadmin privileges on the broker can:\r\n\r\n* Make a login attempt at service A\r\n* ...initiating a token request from A to B\r\n* Generate a token at service B (without needing my credentials)\r\n* ...return the valid response to A\r\n* Now access my account at A\r\n\r\nTo give a concrete example, let's say [Stack Exchange starts accepting Portier logins][1]. What stops my broker from logging into Stack Exchange and [posting questions under my name][2]?\r\n\r\n<!-- Related links -->\r\n\r\n[1]: https://meta.stackexchange.com/q/309697/144115\r\n[2]: https://security.stackexchange.com/q/186622/7062\r\n"},"comment":{"url":"https://api.github.com/repos/portier/portier.github.io/issues/comments/394409865","html_url":"https://github.com/portier/portier.github.io/issues/34#issuecomment-394409865","issue_url":"https://api.github.com/repos/portier/portier.github.io/issues/34","id":394409865,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NDQwOTg2NQ==","user":{"login":"onli","id":900380,"node_id":"MDQ6VXNlcjkwMDM4MA==","avatar_url":"https://avatars1.githubusercontent.com/u/900380?v=4","gravatar_id":"","url":"https://api.github.com/users/onli","html_url":"https://github.com/onli","followers_url":"https://api.github.com/users/onli/followers","following_url":"https://api.github.com/users/onli/following{/other_user}","gists_url":"https://api.github.com/users/onli/gists{/gist_id}","starred_url":"https://api.github.com/users/onli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/onli/subscriptions","organizations_url":"https://api.github.com/users/onli/orgs","repos_url":"https://api.github.com/users/onli/repos","events_url":"https://api.github.com/users/onli/events{/privacy}","received_events_url":"https://api.github.com/users/onli/received_events","type":"User","site_admin":false},"created_at":"2018-06-04T16:06:21Z","updated_at":"2018-06-04T16:06:21Z","author_association":"MEMBER","body":">  But, can Google [the IdP] impersonate me on the website?\r\n\r\nIt can, yes. Portier works basically by asking the IdP for a confirmation that the user trying to login controls the given email address. If someone controls the IdP, starts the login for `otheruser@IdP.com', then makes the IdP wrongly say \"yes, this user controls that account\", then the IdP will be logged in as 'otheruser'.\r\n\r\n> (My recollection is that Mozilla Persona attempted to address this problem?)\r\n\r\nI'm not sure about the details. If there was such a protection, it probably was in the centralized login - with the centralized user account system persona had it could prevent the IdP from impersonating you, since the IdP would not have known your persona password. That would imply there not being a password reset function that uses the IdP...\r\n\r\nBut that login system was also the functionality that made persona confusing and hard to use for new users, it is nothing we want to copy. It is not important anyway: You have to trust your identity provider, he already controls your email and via them your whole online identity. Without a trustworthy IdP there is no point in any authentication scheme that involves his capabilities, in our case: emails and OIDC/Oauth."}}
{"actor":{"display_login":"onli"}}