zaxomion Hacker News • Recommends
On “Ask HN: YouTube down?”
When YouTube comes back up again, I can recommend Tom Scott with "Single Point of Failure: The (Fictional) Day Google Forgot To Check Passwords" link to this video
0:00 / 0:00
#authentication#singlepointoffailure#passwords
Single Point of Failure: The (Fictional) Day Google Forgot To Check Passwords
Tom Scott
6.7M subscribers • 28 videos on Hallway
- Recommended by 4 people: 2 on Hacker News, 1 on Lobsters and 1 in engineering communities.
- A classic. People kept recommending it from 2014 to 2023.
- Presented by Tom Scott
Beginner. No background in the topic needed.
2.3M views12 years ago4 recommendations
SecuritySoftware designWeb and application securityCryptography
Tom Scott tells a fictional story about the catastrophic consequences of a single point of failure in Google's authentication system.
tomscott.com - @tomscott - I spin a (fictional) tale of the day that Google accidentally opened everything. Performed at GeekyConf, with thanks to Betsy Weber and Natalie Downe on camera.Why it's here
4 people recommend thisWhat people say. Highly recommended as a memorable parable illustrating the dangers of centralized authentication and single points of failure.
richardwhiukon Hacker News • Recommends
On “Welcome to Life: the singularity, ruined by lawyers by Tom Scott”
Single Point of Failure: The (Fictional) Day Google Forgot To Check Passwords - link to this video is another, different topic, but still worth watching.
flyingfischon Lobsters • Recommends
Single Point of Failure: The (Fictional) Day Google Forgot To Check Passwords (2014)
u/giusalex1in r/netsec • Recommends
Single Point of Failure: The Day Google Forgot To Check Passwords
jamiewebon Hacker News • Mentions
On “Ask HN: What if gmail was compromised?”
Even worse could be an RCE vuln in Chrome at the same time that the google.com search page gets compromised... Also I think the post you're talking about is this video by Tom Scott: link to this video
pdkl95on Hacker News • Mentions
On “Google outage – resolved”
As many comments in this thread have mentioned, the crash seems to happen when when logged in; youtube and other services seem to work when don't send the session cookie. This suggests something very fundamental related to user account/sessions is failing... Did Maria Christensen make a mistake when adding "return true;"? (This is a joke referencing Tom Scott's 2014 parable1 about the danger of designing a system with a single point of failure . Tom's tells the fictional tale of a high level employee at Google adding "return true;" to the global "handleLogin()" function.) 1 link to this video (you might need to open this link in a private window...)
mikewaroton Hacker News • Mentions
On “Parler Databases Disclosed”
It's basically the scenario Tom Scott laid out about what would happen if Google stopped checking passwords... except it happened to Parler. link to this video
SahAssaron Hacker News • Mentions
On “Google broke a conditional statement that verifies passwords on Chrome OS”
Just reading the title it sounded very much like "Single Point of Failure: The (Fictional) Day Google Forgot To Check Passwords": link to this video
judge2020on Hacker News • Mentions
On “Today Google is turning on tracking for many users that previously turned it off”
…orkspace) goodbye. Once more, even for their ad business, they don't sell that data, they target based off of it. They would lose their competitive data advantage overnight if someone could pay them $100 per-user for every user's full advertising profile since they could then go behind Google's back and out-header-bid Google with lower margins. 0: link to this video 1: link…
iso1631on Hacker News • Mentions
On “Bearer tokens are just awful”
So I have a service using openid and I use google to authenticate the person logging in. I do that, then that's done. Now I could simply issue a session cookie, or a permament cookie, to the client so we never have to use google again. Or I could make it so that cookie lasts 10 minutes before reauthentication. I can use a refresh token which means they don't need to reauthenticate but if google expires the connection (disabled user etc), I expire mine. Either way, that's my decision as the person running my site, and it's the clients decision as the person running the client to decide whether to send the blob, or to share that blob with other clients. The only information I know is that some…