On: Show HN: A microservice that makes adding authentication to your app easy

[homakov]

Yes. Some apps without sensitive info can do it, but that's it.

[pluma → homakov]

So in other words StackOverflow etc (i.e. all non-trivial apps that support third-party login via OAuth) are all broken from a security POV?

[homakov → pluma]

In one way or another. Most are vulnerable to bugs in standard (see sakurity.com/oauth) but every single one depends on central authority which is just stupid for auth.