Don't use third party auth to sign in • Hacker News Board

Re: Don't use third party auth to sign in

#541

Post by u801e » Wed, Nov 18, 2020, 12:28 AM UTC

ukoki wrote: post #517

u801e wrote: post #497

Earlier quoted context omitted.

> app-based, not SMS-based two-factor authentication) How does that work when using an email client and connecting to the server and using SMTP and IMAP?

I meant using TOTP (app-based) two-factor authentication for securing your DNS provider and domain registrar accounts. The reason for not using SMS-based two-factor authentication is that it is not very secure https://techcrunch.com/2016/07/25/nist-declares-the-age-of-s... I'm not aware of two-factor authentication for SMTP or IMAP.

> I'm not aware of two-factor authentication for SMTP or IMAP.

This could be achieved using a client side TLS certificate along with a username and password. I know that Postfix and Dovecot support it.

Re: Don't use third party auth to sign in

#542

Post by smolder » Sat, Nov 21, 2020, 1:39 PM UTC

Fnoord wrote: post #70

lasagnaphil wrote: post #31

Earlier quoted context omitted.

Use a browser plugin like this to always use the old site: https://addons.mozilla.org/en-US/firefox/addon/old-reddit-re...

Doesn't work on Firefox Android. I never go to Reddit by typing URL; I go to Reddit because I follow a link to it.

The plug-in redirects to old Reddit automatically when following links, so if it worked for you that would not be an issue.

Re: Don't use third party auth to sign in

#543

Post by s_gourichon » Fri, Nov 27, 2020, 8:05 PM UTC

anderslemke wrote: post #539

account42 wrote: post #537

Earlier quoted context omitted.

Does Promise get to know which sites you sign in to?

Yes. Promise keeps a map of your sites and IDs.

Isn't that a problem, like "let's get rid of Google and all the evildoers because they know too much about us" then "oh we realize we created another one which knows too much about us"?

Re: Don't use third party auth to sign in

#544

Post by anderslemke » Mon, Nov 30, 2020, 9:18 AM UTC

s_gourichon wrote: post #543

anderslemke wrote: post #539

Earlier quoted context omitted.

Yes. Promise keeps a map of your sites and IDs.

Isn't that a problem, like "let's get rid of Google and all the evildoers because they know too much about us" then "oh we realize we created another one which knows too much about us"?

I get where you're coming from, and this is something I've been thinking a lot about.

It would be possible to not save the map, and then use some kind of hashing to infer user ids for each site. I chose not to do this, to be able to guarantee no collisions. This might be silly, though. But the thought of people with colliding user ids makes me giddy.

The data stored looks something like this: { "ids": { "example.com": { "07c5c163-875f-424c-a659-a4f99e74eb12": "default" }, "other-example.com": { "ab38b2a6-d560-43d3-b2a3-9148cd91d1b4": "default" } } }

Worth noting is, that there is no personally identifiable information (PII) here.

But we have to have the discussion if this is "too much" data to keep about a user. AFAIK this is the bare minimum of data needed, to be able to guarantee no collisions of user ids. If there is another way to do it, we should do that!