thrwaway2020aug (u/thrwaway2020aug)

thrwaway2020aug commented on Launch HN: MagicBell (YC W21) – embedded notification system for your product · Posted by u/unamashana

unamashana · 5 years ago

Edited the doc to remove the bit about this scenario being unlikely. We take security very seriously and would be happy to get feedback on the new copy (or any other aspect of MagicBell).

thrwaway2020aug · 5 years ago

I see your point with Intercom, but it feels like you're arguing that two wrongs make a right. It doesn't make me think MagicBell takes security very seriously, but perhaps I'm just paranoid.

Regardless, the copy on the website is improved. You may also want to add a warning and link anywhere your website documents the "userEmail" option.

On another note, in terms of the implementation here, I'm surprised you're asking users to use HMAC and base64 manually, instead of using standardized JWTs. Did anything in particular motivate that decision?

I quite like the product overall - I think it's very clever how you componentized everything. The security decisions just have me concerned.

thrwaway2020aug commented on Launch HN: MagicBell (YC W21) – embedded notification system for your product · Posted by u/unamashana

unamashana · 5 years ago

There are two ways to handle that. One is to use your external ID, if they are UUID or something random. That's security by obscurity.

The other (and better way) is to initialize the embed with an HMAC generated on your backend using the API Secret. You can do this with both email and external_id - https://developer.magicbell.io/docs/turn-on-hmac-authenticat....

thrwaway2020aug · 5 years ago

Hello! Great product and congrats on the launch!

I wanted to pile on a little bit here and say this paragraph isn't really comforting to me:

> While unlikely to happen, it is possible for a savvy user to open their browser's developer console, obtain your MagicBell project's API key from your website's source, initialize the widget on their own website with your API key but with a different user's email (if its feasible for them to guess one) and start viewing notifications of that user.

I suspect this was done for developer experience reasons? You seem to know it's not secure to pass in an email directly, especially if anything sensitive is coming across in notifications.

For me at least, allowing the non-HMAC configuration makes me wonder what other security corners have been cut. I'd rather that option didn't exist and the company took a more security-forward stance.

thrwaway2020aug commented on Heavy is the Head that wears the AirPods Max daringfireball.net/2020/1... · Posted by u/ch_sm

kevincox · 5 years ago

I am somewhat disappointed that we associate weight with quality. I assume this came from early plastics that were brittle and started to replace metal parts. But the science of plastics have come so far, we have plastics that are incredibly durable while still being lightweight. However many manufacturers are sticking to metal and glass for that "premium look and feed" even if it is heavier and less durable.

Another issue might be the variety of plastic qualities that are hard to tell apart from a quick impression. Something that our launch followed by rush to quick reviews society can't adequately test. Glass and especially metals tend to have more predictable durability profiles.

I think the main problem that we haven't solved in plastics is hardness, so glass screens are here to stay, but I wish we could move away from this plastic == low quality perception. I think it would result in better products at then end of the day.

thrwaway2020aug · 5 years ago

The ski boot industry has been focused on reducing plastic weight / thickness while remaining sturdy. People very much appreciate the innovations there.

thrwaway2020aug commented on Improving DNS Privacy with Oblivious DoH blog.cloudflare.com/obliv... · Posted by u/websirnik

thrwaway2020aug · 5 years ago

I'm surprised to see Cloudflare and Apple collaborating on privacy.

What does Cloudflare think of Safari's new CNAME-cloaking detection to block cookies? https://webkit.org/blog/11338/cname-cloaking-and-bounce-trac...

The reason I ask is because Cloudflare's "orange cloud" DNS mitigates that protection because it prevents Safari from detecting the cloak. On the other hand, I haven't run into many engineers who think CNAME-cloaking actually hurts privacy in light of Safari's other efforts to partition local storage.

Does Cloudflare think it would be help privacy for Apple to know the final IPs behind orange cloud DNS?

thrwaway2020aug commented on Launch HN: SuperTokens (YC S20) – Securely manage session tokens · Posted by u/advaitruia

rishabhpoddar · 6 years ago

Thanks! The benefits we provide are session security and convenience (not having to know or think about tokens and session management).

We don't use normal refresh tokens. We use one time use refresh tokens. This allows to detect token theft in a reliable way for long lived sessions (https://tools.ietf.org/html/draft-ietf-oauth-browser-based-a...).

Also, OAuth is different to session management in that OAuth is for delegation purposes, whilst "a session" can be used to maintain authentication between your own frontend and backend.

In terms of revocation of sessions, our SDK provides functions that can be used to revoke sessions. Soon, we will be making a dashboard that can be used to do the same (and other things)

thrwaway2020aug · 6 years ago

Thanks for your response!

I'm still a bit confused why you're referencing OAuth here and in the launch announcement while also saying "OAuth is different to session management"

Why have you chosen to use OAuth solutions if you're not solving an OAuth problem? How are you sure it's still the right solution? I see some overlap but it's not obvious to me that OAuth methodologies should be applied here.

thrwaway2020aug commented on Launch HN: SuperTokens (YC S20) – Securely manage session tokens · Posted by u/advaitruia

thrwaway2020aug · 6 years ago

Congrats on launching!

If I understand correctly, you're having me integrate a library on my backend that manages session cookies.

You've implemented refresh tokens and that seems to be one of your major selling points, but I'm confused what benefit that provides?

I thought the use case for refresh tokens in OAuth was that the user can revoke access from the OAuth provider side. But since the user can't go to SuperTokens and revoke their session, isn't the refresh token functionality superfluous?