Re:Users don’t need a password
by earenndil on Sunday October 29, 2017 @12:39PM
(#15579963)
Just make an app that automatically connects to your email, gets and parses the email (there can be a specific format) and asks "would you like to sign in to slack?" And you can just press "ok" and you'll get in. To make it even better, you can make it so that the email is signed by a pgp key you've previously trusted ("would you like to sign into trusted provider 'slack'?"), to make it resilient against phishing emails, and for extra protection the slack sign in page can show a random series of 6 digits, which is also emailed to you, so a phishing email wouldn't have access to those 6 digits; and you can compare those to what the app shows you.
[ Parent
| on HN ]
I had been prepared to make a comment saying that the article's proposed flow is essentially the same as oAuth, except your email service acts as your identity provider and it is all manual.
But I have a feeling you may be facetiously getting at the same thing. Or are you?
i always like solutions that start with "just make an app". Especially if the problem is about convenience.
Just?
Also, the only application that should have an actual access to your mail is your client.
Sure, it could hook into your email client. And it would be opensource. Wouldn't have to be complicated, could even be CLI.
Re:Users don’t need a password
by proginthebox on Sunday October 29, 2017 @01:38PM
(#15580324)
you mean like some modification of OAuth?