What Craigslist Did Right: User Management Without Usernames or Passwords
1–10 of 35 posts
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#2I think Craigslist's authentication scheme only works if your users don't need to be logged in very often. Otherwise it's a royal pain.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#3I think Craigslist's authentication scheme only works if your users don't need to be logged in very often. Otherwise it's a royal pain.
The nice thing about Craigslist's authentication is that it allows casual users to post easily (and anonymously) without having to create an account, but they also allow you to create an account if you plan to use the service often.
They are able to account for both types of people.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#4I think Craigslist's authentication scheme only works if your users don't need to be logged in very often. Otherwise it's a royal pain.
The nice thing about Craigslist's authentication is that it allows casual users to post easily (and anonymously) without having to create an account, but they also allow you to create an account if you plan to use the service often. They are able to account for both types of people.
It seems if you later decide to make an account, it aggregates all your posts into a useful summary pane.
I was able to sell a couple of things using Craiglist. I was surprised at how easy and smooth it went.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#5I think Craigslist's authentication scheme only works if your users don't need to be logged in very often. Otherwise it's a royal pain.
The nice thing about Craigslist's authentication is that it allows casual users to post easily (and anonymously) without having to create an account, but they also allow you to create an account if you plan to use the service often. They are able to account for both types of people.
Good point I wasn't thinking about the account creation part when I read the article. I have only posted once on CL and didn't create an account.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#6"These days, disabling your cookies would make it nearly impossible to use any web application. I’m not sure if people are still out there browsing the web with disabled cookies, but if you are, my hat’s off to you! :)"
I use Firefox + Cookie Monster, which allows me to enable temporary cookies for the sites that I'm just browsing and permanent cookies for my webmail and social networking sites.
The only site which sits in the middle of these -- it breaks without cookies but I don't use it enough to justify cookies -- is scribd. It's gotten to the point where I actively cringe whenever I see the word "scribd" anywhere. Basically they show you a perfectly working presentation for about ten seconds and then suddenly send you on an infinite redirect loop which simply says "optimizing your Scribd experience", and once you temporarily enable cookies they dump you on an index page having nothing to do with the presentation you just started reading.
I might shift them to a "store cookies permanently" exception, but it still bugs me. You should never require cookies for content which can be read by solely clicking "Temporarily Allow Cookies for this domain name." Cookies don't do anything if you delete them immediately after the transaction is over. (I am looking especially at you, New York Times: you are guilty, guilty, guilty of this.)
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#7I’m not too familiar with Rails (and this is unrelated to the point of the article), but is this code vulnerable to a session fixation attack (https://www.owasp.org/index.php/Session_fixation)?
I notice that it doesn't destroy the session when you log in/out, just changes a session variable.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#8This can work if your app is an impersonal one like CraigsList. It doesn't if it's a social one where you want people to use an username, or their full name to interact with other people.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#9I’m not too familiar with Rails (and this is unrelated to the point of the article), but is this code vulnerable to a session fixation attack ( https://www.owasp.org/index.php/Session_fixation )? I notice that it doesn't destroy the session when you log in/out, just changes a session variable.
No; session fixation requires that the attacker gain access to a session id and pass that on to the user. Rails doesn't use session ids by default. All session data is stored in the client cookie, and is verified with a cryptographic hash. If you can steal the cookie, you win, but that's much harder than session fixation.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#10Is this any different than just generating a random string and emailing it to them? I don't see the need to do the email/salt thing in this case.