Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: ClapChat – Instant messaging for HN users

clap.chat

Post reply on HN
Print view View original

11–20 of 65 posts

Re: Show HN: ClapChat – Instant messaging for HN users

#11

Post by todd3834 »

zaroth wrote: post #10

Just a thought on the auto-login functionality... If I run an intercepting proxy and alter all instances of my username in the HTML response from HN servers to appear in every way to be logged in as 'dang'.... How would your extension detect the forgery?

Glad you asked! So here is a teaser on how it works: 1. ClapChat gives you a unique id, the extension posts the id in your profile, ClapChat independently verifies that your profile contains the correct ID so that we know you really do own the account, then we double check the ID vs the session that we gave the id to and we can validate the authorization.

I'm working on a blog post that goes into much further detail and will post soon.

Re: Show HN: ClapChat – Instant messaging for HN users

#12

Post by todd3834 »

todd3834 wrote: post #11
zaroth wrote: post #10

Just a thought on the auto-login functionality... If I run an intercepting proxy and alter all instances of my username in the HTML response from HN servers to appear in every way to be logged in as 'dang'.... How would your extension detect the forgery?

Glad you asked! So here is a teaser on how it works: 1. ClapChat gives you a unique id, the extension posts the id in your profile, ClapChat independently verifies that your profile contains the correct ID so that we know you really do own the account, then we double check the ID vs the session that we gave the id to and we can validate the authorization. I'm working on a blog post that goes into much further detail…

In a way, it's kind of like validating a domain name using a TXT record.

Re: Show HN: ClapChat – Instant messaging for HN users

#13

Post by JoeCortopassi »

todd3834 wrote: post #11
zaroth wrote: post #10

Just a thought on the auto-login functionality... If I run an intercepting proxy and alter all instances of my username in the HTML response from HN servers to appear in every way to be logged in as 'dang'.... How would your extension detect the forgery?

Glad you asked! So here is a teaser on how it works: 1. ClapChat gives you a unique id, the extension posts the id in your profile, ClapChat independently verifies that your profile contains the correct ID so that we know you really do own the account, then we double check the ID vs the session that we gave the id to and we can validate the authorization. I'm working on a blog post that goes into much further detail…

Btw, we also plan on open sourcing all this. So everyone will be able to give feedback and contribute. The hope is it becomes a really useful tool for the community

Re: Show HN: ClapChat – Instant messaging for HN users

#14

Post by todd3834 »

zaroth wrote: post #10

Just a thought on the auto-login functionality... If I run an intercepting proxy and alter all instances of my username in the HTML response from HN servers to appear in every way to be logged in as 'dang'.... How would your extension detect the forgery?

Here is an early diagram I made when we were exploring the idea. It's not the complete story but hopefully it communicates the general idea https://s3-us-west-1.amazonaws.com/www.clap.chat/assets/HN-a...

Re: Show HN: ClapChat – Instant messaging for HN users

#16

Post by todd3834 »

Daviey wrote: post #15

How does this differ from hnchat that was posted back in September, especially around user auth? https://news.ycombinator.com/item?id=12431724

Very cool! I hadn't heard of HNChat but the authentication process is very similar. I like the idea of letting user's manually add the id if they want to. I think we may make it optional to automatically handle it for you or let you do it manually.

Biggest difference from my first impression of hnchat is that we built ours as a chrome extension and you participate directly on HackerNews instead of an external domain.

Re: Show HN: ClapChat – Instant messaging for HN users

#18

Post by JoeCortopassi »

qwertyuiop924 wrote: post #17

...So, unlike HNchat, which was a live chatroom, this is like that PM system that we all want (so we can have PMs, and so people will stop posting HN messages that tell you to email them), but still don't have for a variety of reasons? I'm sold.

That's the hope. Make it easy to take the conversation offline and help each other out :-)

Re: Show HN: ClapChat – Instant messaging for HN users

#19

Post by JoeCortopassi »

Daviey wrote: post #15

How does this differ from hnchat that was posted back in September, especially around user auth? https://news.ycombinator.com/item?id=12431724

The main difference is that this enables private messaging between users, regardless if they are signed up or not. Next time you're in a thread, you'll see a button to send a message next to their username. Click, and it will start a message without you having to leave the page. HNChat on the other hand seems to be more of a separate place to have conversations as a group. I feel like there is a place for both, they just solve different problems
Post reply on HN