OAuth for the Open Web

Re:OAuth for the Open Web by lstamour on Saturday July 07, 2018 @06:55PM (#17481123)

Great, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of accounts you’ve recently used so you can pick one and sign in—and enter a URL (or email) only if you need to.

[ Parent | on HN ]

Re:OAuth for the Open Web by daveid on Saturday July 07, 2018 @07:19PM (#17481225)

Unless there's gonna be native browser support, the different websites you visit won't be able to know which accounts you've recently used elsewhere.

[ Parent | on HN ]

Re:OAuth for the Open Web by dane-pgp on Saturday July 07, 2018 @08:03PM (#17481375)

If browsers were to support this, there would be some tricky UI/UX questions about how readily the browser provides information to a new website about accounts you have on other sites.

Such a feature might best be specified as an extension to this API:

https://developer.mozilla.org/en-US/docs/Web/API/Credential_...

which although experimental does have some level of browser support.

[ Parent | on HN ]

Re:OAuth for the Open Web by dwaite on Sunday July 08, 2018 @09:14PM (#17487297)

The web credential API is meant to be an integration point for passwords and AccountChooser in your browser. But I don't know if any other browsers than Chrome plan to implement it.

[ Parent | on HN ]

Re:OAuth for the Open Web by lwf on Sunday July 08, 2018 @01:31AM (#17482305)

Don't expose it to the web page, but treat it as a native UI control.

[ Parent | on HN ]

Re:OAuth for the Open Web by lstamour on Sunday July 08, 2018 @11:56AM (#17484374)

Unless you centralize the list as AccountChooser.com does using Local Storage.

[ Parent | on HN ]

Re:OAuth for the Open Web by dane-pgp on Saturday July 07, 2018 @07:48PM (#17481328)

You mention "URL (or email)", so I think it is worth pointing out that there is a standardized way of converting an email address into an HTTP URL, namely WebFinger.

The RFC even includes an example of doing something very similar to this use case:

https://tools.ietf.org/html/rfc7033#section-3.1

[ Parent | on HN ]

Re:OAuth for the Open Web by EGreg on Saturday July 07, 2018 @07:18PM (#17481220)

The problem is, where do you store this list? The Web doesn’t have a way to store things except at a particular domain, and that domain will then know everything.

Anyone remember xAuth effort led by Meebo and others? It ran into the same objections for using a centralized domain for the time being even though it was great.

[ Parent | on HN ]

Re:OAuth for the Open Web by maxerickson on Saturday July 07, 2018 @07:19PM (#17481223)

Browsers could implement that part of the UI. Like address autofill.

[ Parent | on HN ]

Re:OAuth for the Open Web by EGreg on Saturday July 07, 2018 @07:35PM (#17481275)

And until then what do we do?

[ Parent | on HN ]

Re:OAuth for the Open Web by maxerickson on Saturday July 07, 2018 @07:38PM (#17481289)

Cry in our beverages of choice.

[ Parent | on HN ]

Re:OAuth for the Open Web by mblaney on Sunday July 08, 2018 @08:17PM (#17487086)

I made a bookmarklet that will store a url for you, and sign you in. You can create your own at: https://unicyclic.com/usb

[ Parent | on HN ]

Re:OAuth for the Open Web by lstamour on Sunday July 08, 2018 @11:55AM (#17484369)

The existing AccountChooser interface, which was Google’s preferred SSO strategy until their recent experiments with zero-click SSO, was hosted at AccountChooser.com by the OpenID folks.

[ Parent | on HN ]