Hacker News
points by Betelbuddy 3 days ago | 0 comments
Yes OAuth ....

"At the end, I reached the conclusion that OAuth 2.0 is a bad protocol. WS-* bad. It is bad enough that I no longer want to be associated with it. It is the biggest professional disappointment of my career.”

   - Eran Hammer, lead author and editor of OAuth 2.0 spec
"All the hard fought compromises on the mailing list, in meetings, in special design committees, and in back channels resulted in a specification that fails to deliver its two main goals – security and interoperability."

   - Eran Hammer, lead author and editor of OAuth 2.0 spec
[–] JohnMakin 3 days ago
It should be noted his criticism was because he thought 1.0 was better (which he created), not a fundamental issue with OAuth itself.

> Eran Hammer, lead author and editor of OAuth 2.0 spec

I do not think this is a completely full characterization - he left the project over his criticisms of it and withdrew his name from all of it.

[–] helsinkiandrew 3 days ago
And MCP requires OAuth 2.1 which covers some of his criticisms.