News for hackers. Stuff that matters.

A comment on Show HN: Login with HN (Unofficially).

Re:Show HN: Login with HN (Unofficially) by simonw on Thursday January 13, 2022 @01:02PM (#29924205)
This is a smart implementation. I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives you a token to embed in your public profile - so it's still scraping your profile page, but that feels like a very low-impact way of building this.

Suggestion: on the "Put the token below in your HackerNews Profile" page, rather than polling to see if the token has been added (which is a bit rude) add a button for "I have added this token to my profile" and only check once the user clicks that button.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by johnkpaul on Thursday January 13, 2022 @01:30PM (#29924599)
I totally agree with you and I was also worried about uncouth behavior. That said, and not to undercut the smartness here, I have memories of this being the main mechanism to authenticate third party services to the SomethingAwful forums.

I have vague memories of thinking through how scraping could be used for much easier global authentication and then quickly how that was probably a dumb idea.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by eloisius on Thursday January 13, 2022 @08:31PM (#29929481)
Reminds me of how I got users to verify their ownership of Minecraft accounts[0]. There is no profile to add a token, but they can switch their skin, and you can download a user’s skin without being in-world.

[0] http://zacstewart.com/2012/12/24/verifying-minecraft-user-ac...

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by timvdalen on Friday January 14, 2022 @09:45AM (#29935037)
Cool write-up! Wouldn't you need to generate a new random verification skin for everyone that tries to verify?
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by eloisius on Friday January 14, 2022 @10:22PM (#29943227)
This is long dead, but yes that would be the next step. At least right now, you could only falsely claim someone’s account if they installed my verification skin, but you could wait for someone to do that and then quickly claim their account before they did.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by tata71 on Thursday January 13, 2022 @01:55PM (#29924982)
Instead, the token (a text string) will be an "object" (a non fungible token) that you prove is in your wallet with zk proofs,

wallet being on whatever chain(s) decided upon as ubiquitous in the coming year.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by floatingatoll on Thursday January 13, 2022 @02:14PM (#29925296)
I assume this is /s and I laughed when I read it. Well played.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by meowkit on Thursday January 13, 2022 @05:05PM (#29927567)
It’s not sarcasm, and it is what some communities want to achieve with decentralized identification.

https://www.microsoft.com/en-us/security/business/identity-a...

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by nvr219 on Thursday January 13, 2022 @01:51PM (#29924933)
Yep, I still do this with gbs.fm!
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by johnkpaul on Friday January 14, 2022 @09:14AM (#29934604)
Ah the memories and nostalgia of seeing this comment are immense! I miss the good ol' days of the pre tech giant internet. I used to go to the in person NYC charity events and it was an awesome community.

:wave: other goon, hope you and all are well.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by Lorin on Thursday January 13, 2022 @04:55PM (#29927423)
Have you considered playing more Journey? :^)
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by tomphoolery on Thursday January 13, 2022 @05:16PM (#29927704)
this site is the last place i thought i'd find a gbs.fm reference
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by Lorin on Monday January 17, 2022 @12:22AM (#29963580)
Had to migrate somewhere!
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by dmix on Thursday January 13, 2022 @02:34PM (#29925607)
What is gbs.fm if you dont mind me asking?
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by nvr219 on Thursday January 13, 2022 @04:03PM (#29926816)
A community radio station where you have to be a somethingawful member to access.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by gresrun on Thursday January 13, 2022 @02:53PM (#29925895)
Some quick Googling yielded: https://forums.somethingawful.com/showthread.php?threadid=38...
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by rsync on Thursday January 13, 2022 @02:11PM (#29925228)
"... I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives you a token to embed in your public profile ..."

I have a side project I've been kicking around for a while that required some kind of reputation/login/accountability function and this was exactly what I considered doing: giving people a token to put into a public HN profile.

So anyway, great job Victor!

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by hardwaresofton on Thursday January 13, 2022 @02:19PM (#29925363)
Hey if you don't mind I'd love to have you kick the tires -- there aren't any client apps (other than the website itself) right now, but I'll be opening that up soon, got some bits to batten down like audience and registration forms.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by rsync on Thursday January 13, 2022 @02:30PM (#29925544)
So, so pessimistic that I can carve enough time away from rsync.net to start this new initiative ... but we'll see ...
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by hardwaresofton on Thursday January 13, 2022 @02:51PM (#29925858)
rsync.net is a massively awesome product, I think I can safely say the rest of the internet is hoping you don't get any time away :).
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by irthomasthomas on Thursday January 13, 2022 @05:25PM (#29927812)
The tyranny of success.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by dheera on Thursday January 13, 2022 @01:49PM (#29924902)
> doing something uncouth like asking for your HN password

Yeah I was worried about this too, it's a disturbing trend.

Venmo was asking for my bank password a couple months ago, I was like fuck no. Who the HELL does that. Should be illegal to even ask.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by simonw on Thursday January 13, 2022 @02:40PM (#29925697)
I complained about that Venmo thing on Twitter and got an interesting conversation going about it, including with comments from the CTO of Plaid who are the company who built that integration.

https://twitter.com/simonw/status/1479174549266526209

Short version: OAuth for banks is finally starting to happen, but in the meantime the password anti-pattern fills the gap.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by KoftaBob on Thursday January 13, 2022 @02:13PM (#29925287)
In the case of venmo (and many other of their customers), it was actually Plaid that was asking for your bank login credentials to connect your bank account to Venmo. They've been getting criticism regularly for that, unsurprisingly.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by floatingatoll on Thursday January 13, 2022 @02:16PM (#29925322)
(And Plaid noted that they vastly prefer to oauth to banks, and do with many other banks, but that Venmo won’t accept oauth and demands credentials.)
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by Operyl on Thursday January 13, 2022 @03:35PM (#29926459)
No that’s not correct. Venmo is not forcing password auth, it’s banks not implementing the OAuth flow that causes this. I just went through with OAuth in Venmo with my bank (Capital One). They also offer traditional (deposit 50 cents and validate the amount) work flow too, they’re not forcing the Plaid model at all.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by floatingatoll on Thursday January 13, 2022 @06:08PM (#29928304)
Erm, I don’t think we’re describing the same sides of the flow, but I trust you’re right anyways. Apologies for my confusion.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by dheera on Thursday January 13, 2022 @03:00PM (#29926009)
Yeah so now I need to give my password to not just Venmo but also some startup called Plaid that I need to trust?

Doubly fuck no.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by zwily on Thursday January 13, 2022 @03:31PM (#29926425)
Plaid is not some tiny startup... They're almost 10 years old and Visa tried to buy them for $5B a couple years ago.

That doesn't mean you should trust them (I don't), but just because you haven't heard of them doesn't mean they're not big.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by Operyl on Thursday January 13, 2022 @03:37PM (#29926495)
Venmo offers the traditional verify a deposit amount validation method too, it just takes a few days. It’s an either or method.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by phoenixy1 on Thursday January 13, 2022 @03:22PM (#29926308)
To clarify -- Venmo doesn't get the credentials at all, only Plaid does. Venmo then uses an API to get the specific bank account data it needs from Plaid.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by dheera on Thursday January 13, 2022 @04:46PM (#29927337)
I still don't trust Plaid.

Venmo could also get the credentials if they want to, since they're launching it from within their own app. They could keylog everything in their app if they wanted to, including what happens inside Plaid.

Nobody should ask for passwords to anything but their own service. Period.

Asking for bank passwords should be made illegal. If I were the president I would have made that a federal law yesterday.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by Larrikin on Thursday January 13, 2022 @10:10PM (#29930180)
The president doesn't make legislation.

Plaid provides a useful service that's a stop gap for the poor infrastructure of banks. I honestly doubt that most banks would have even bothered to start the laborious process of OAuth without them being an extremely popular middle layer for services like YNAB. My company actually uses them to process recurring payments.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by dheera on Friday January 14, 2022 @01:50PM (#29938461)
Yeah well I would have also made it a law for banks to support OAuth and hardware key 2FA, hand out 2 Yubikeys to every citizen and ban SMS, among other things.

Plaid is not useful if they need to ask for passwords.

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by neither_color on Thursday January 13, 2022 @09:30PM (#29929937)
This recently started happening with Paypal. Bank payments were my default, and recently when I tried to buy something paypal started demanding my bank login. Nope. Not now. Never. You do not need to know my balance and all my transactions for a $100 purchase, Paypal.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by sattoshi on Thursday January 13, 2022 @02:29PM (#29925524)
For all the obscure examples of prior art being given in this thread, this is also how Keybase did proofs with HN.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by tlarkworthy on Thursday January 13, 2022 @01:29PM (#29924585)
the exact user flow for a third party Auth system in Observablehq

https://observablehq.com/@endpointservices/login-with-commen...

all code is ISC licensed and both the server and client is embedded in a web notebook

[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by clay-dreidels on Thursday January 13, 2022 @03:22PM (#29926298)
This is very clever. On a side note, I wish HN offered two-factor authentication.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by kogir on Thursday January 13, 2022 @05:33PM (#29927903)
Just pick a good password and don’t reuse it elsewhere. HN is super aggressive about rate limiting attempts, so brute force isn’t really a risk.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by maxwell_xander on Thursday January 13, 2022 @08:13PM (#29929356)
2FA also protects me in case someone runs https://github.com/unode/firefox_decrypt on my computer, maybe as part of an NPM install script
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by MajesticHobo2 on Thursday January 13, 2022 @10:45PM (#29930378)
Do you not stay logged in to HN?
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by maxwell_xander on Friday January 14, 2022 @12:46PM (#29937526)
Never! I log out EVERY... nah, you got me haha. I honestly wouldn't even care if someone stole this account. Just having fun nitpicking :)
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by MajesticHobo2 on Thursday January 13, 2022 @10:39PM (#29930344)
Phishing is still an issue that could be prevented with security keys. That said, I don't see most HN accounts being very interesting to phishers.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by iyn on Thursday January 13, 2022 @04:04PM (#29926837)
+1, would be nice to have 2FA
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by waffle_maniac on Thursday January 13, 2022 @04:15PM (#29926967)
What about a cryptographic signature? That might be nice.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by freedomben on Thursday January 13, 2022 @01:40PM (#29924755)
Agreed, and it doesn't really matter but for some reason I felt compelled to mention, this same mechanism (putting token in profile page) has been in widespread usage for years so isn't novel. Keybase is one example.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by tiffanyh on Thursday January 13, 2022 @01:49PM (#29924896)
Even before that, this is a common practice with DNS for decades to prove ownership of a domain.
[ Parent | on HN ]
Re:Show HN: Login with HN (Unofficially) by curiousgal on Thursday January 13, 2022 @02:10PM (#29925225)
SPF

DKIM

Let's Encrypt Certificates

[ Parent | on HN ]