251–260 of 279 posts
Earlier quoted context omitted.
Lots and lots and lots of sites fail because they depend on jquery hosted by google.
Interesting, that makes their altruistic (CDN) hosting seem slightly more strategic.
Is it too short? Or not insightful enough? Or.. do you disagree with his opinion?
Earlier quoted context omitted.
I think this is an issue that needs to be dealt with in schools, because it's going to be VERY important by the time current kids grow up, and most of them don't know what they're doing. Here's what I do. I have two branches of passwords: one unsecure and easy to dictionary attack, another that was randomly generated and I got into muscle memory when I was a boy. Each secure site gets its own slightly different versi…
I use pretty much the exact same system that you do and have done so for many years as well. Recently though, I'm starting to think I might try out the password management software route. I've haven't yet had a problem with any of my accounts being brute forced and I guess there's something to be said for "if it 'aint broke...", but reviewing the passwords I use, even the more secure ones, I have this nagging feeling…
I haven't looked into the technical details deeply but people keep talking like OpenID is safe. I assume sites that use OpenID never see my user name and password but what if the site says that it uses OpenID but actually just stores my user name and password? Would I have any way of recognizing that the site was using fake OpenID?
This is by far my largest complaint with Quora.
Personally I don't like any of these global logon initiatives. I don't use Stackoverflow because I never found a way to login without using OpenID. Since I don't like a bunch of random web sites being able to connect me so easily, to use Stackoverflow I would have to go to one of those openID sites and make a fake account or set up my own OpenID provider. Both of these options are extremely inconvenient. I'm used to…
Sites you log into using OpenID never see your password. (For that matter, any competent OpenID provider will never store your password in cleartext, so they won't know it either.) The only thing the site knows is your OpenID url, and when you sign in using that, it redirects you there, to enter your password.
Live example. I use myopenid.com to provide OpenID services, delegated via a link rel="openid.delegate" tag on my personal site, bbot.org.
When I want to sign in via OpenID on a site, say, livejournal, I type in "bbot.org". Livejournal looks at that site, reads the link tag, and sends me to myopenid.com. I sign in there, and it sends me back to livejournal, now logged in.
Earlier quoted context omitted.
I think the following Adblock Plus filter rule would do the trick: ||facebook.com^$third-party
This is what you want: ||facebook.com^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||facebook.net^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||fbcdn.com^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net ||fbcdn.net^$domain=~facebook.com|~facebook.net|~fbcdn.com|~fbcdn.net The key is to allow FB's CDN when on FB, but to disallow it and everything else when not on FB. I'm never on FB…
After years of lurking on Hacker News, I finally created an account simply to be able to post the strongest agreement possible with the original post. I do not use Facebook, and I do not wish to use Facebook, and I do not believe that I should be treated as an Unperson because of this choice. If a site wants to make certain its users/members are using their "real identity", better solutions can be found than tying th…
No one is forcing you to use a site that requires Facebook, but obviously (based on the comments here like yours) companies requiring it should probably rethink this if their primary audience is tech-savvy geeks.
Universal Login 1.0 File:
(ULAPI-1.0 (username "oconnore")
(seed "a3k5...") (password-hash "pq3i...") (password-hash "ve83...")
(additional-information (eye-color "brown") (email "@.com") ...)))
Cool benefits of this are that you can use separate passwords for your bank and your twitter, and you can host your own ID (or pick someone you trust), only allow certain servers to request it, dynamically generate a unique ID for each site, etc.
I find no problem with OpenID. There are many free OpenId providers out there, and if you really don't want to use one, you can create your own fairly easily.
The issue is that it should be an extension for your app, not a rule. I think, that the best way is to always do you own auth system and maybe improve it using OpenId providers.
Earlier quoted context omitted.
The items you mentioned mitigate but do not "solve" the problem. We often have users forget what email address they used when they first signed up (work, personal, their kids email because they aren't a "computer person", etc). Probably not so coincidentally, these same users are the ones that struggle the most with basic computer tasks like opening a URL from an email, etc.
You can just let users initiate a request with their login name, no?
(EDIT: Oh, and I misunderstood your comment: no, you cannot have them initiate the request with their username, because they probably also forgot their username. I thought you were saying that they could initiate a request to look up their username before looking up their password, which has the "no stable identifier" problem I ended up going into.)