Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by peanut-walrus | Hacker News Reader

Parent Full thread

peanut-walrus·

No. No. God no. Do not ever do that.

The email address you get from an oauth provider should never be trusted.

View on HN

Mostly but not entirely true. If Google oauth gives you an @gmail.com email, you can trust it.

A more accurate formulation would be: the email address you get from an oauth provide must not be trusted unless the oauth provider controls the email domain and guarantees no re-use of addresses.

Not that it’s practical to special case every such provider, but with Gmail handling 25% of email, there can be good UX affordances for them a few others.

Even in the case of gmail, which is the best case, you can not be sure the person in control of the Google account is the same as the one that used that gmail address to create an account on your site. The person might have got their Google account hacked, they might have used a shared gmail account to sign up, your service might not have been properly verifying email addresses when they signed up, etc.

But yes, to be fair, if you have email-based password reset functionality, it is not really an additional security vulnerability.

Control of the Gmail account and ability to get an oath token for that account are one at the same, as far as I know. Both indicate you’ve authenticated as that user with Google.

There are a few others. I’m not sure it’s worth the special casing, but it can be a better user experience.

'Never' is a bit strong. It depends a lot on what you're using the email address for. And it's probably safe to trust gmail addresses coming from google, for instance.

Reply on news.ycombinator.com