Live data from Hacker News

What Craigslist Did Right: User Management Without Usernames or Passwords

jobpoacher.com

11–20 of 35 posts

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#11
Craigslist has a big spam problem to deal with; anonymous e-mail based accounts make spamming very easy. They've dealt with this through phone verification -- if you try to post to a high-spam category, or your account is otherwise suspicious looking, you get prompted to enter a phone number and take an automated call or SMS with a code to put in the site. That phone number gets tied to your e-mail and can't be used to authenticate another, so spamming now requires throwaway phone numbers (harder to acquire) instead of throwaway emails.

I haven't made any attempt to test it, but they probably block using VOIP and other non-fixed phone numbers too. There are APIs available to check whether a number is one of those types, so, say, you can't sign up for a bunch of numbers through Twilio and use those to spam Craigslist.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#12
post #6

"These days, disabling your cookies would make it nearly impossible to use any web application. I’m not sure if people are still out there browsing the web with disabled cookies, but if you are, my hat’s off to you! :)" I use Firefox + Cookie Monster, which allows me to enable temporary cookies for the sites that I'm just browsing and permanent cookies for my webmail and social networking sites. The only site which s…

Scribd over-complicating things since they used PDFs to display text.

I just visited their site again, I'm not exactly sure what they are using now, it does look good, but my god is it slow on my low end machine.

I am not surprised to hear they are needlessly complicating session tracking as well.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#13
"Ask rails developer how to do authentication, and you’re likely going to hear 'devise' or 'authlogic'. These are great solutions for most use cases."

I like that the author thought through what the minimum amount of code needed would be to get the job done for his specific case. However with recent improvements to Rails, Authlogic & Devise are usually overkill even if you are going the standard route. It's easier than you think to roll your own, and you'll end up with a similar amount of code. Here's a good post summing it up: http://www.farbeyondprogramming.com/2011/05/63-rails-user-au...

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#14
Not having a mandatory registration step definitely lowers the entry barrier for new users. Doodle (doodle.com) uses a similar technique for their polls. A user doesn't need to create a login to manage a poll, he just gets an admin URL and he/she can use that to edit/delete/manage the poll later on. Participants, meanwhile, get a different participant URL that does not have the admin options. Their pages are not served over HTTPS though, so I suppose it's not perfectly secure.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#15
This looks wide open to csrf attacks.

Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user.

Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#16
Not to be cynical, because I don't necessarily think there is a "right" answer for this particular application, but I don't see a huge advantage in doing this over a simple registration form with a password.

An email is a unique field anyway, so when you say that "nobody likes creating a new username and password for a website" you are making the process sound more complicated than it really is. For the case of this site, the only difference is whether or not a password is required to log in. Additionally, should you want to add user-specific functionality later that persists across sessions, you will have to add an authentication system.

Again, that's not to say that this method is right or wrong, but I myself have started down the road of maintaining sessions with cookies instead of full-blown authentication, and every time I have ended up going back to authentication because I always end up deciding that the benefits outweigh the drawbacks.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#17
I know I'm probably asking a stupid question, but why can't my browser adopt some variation of OAuth and automatically authenticate me everywhere, forever? Imagine if we never had to discuss sign-up forms anymore. Everyone has an identity built into the browser, no questions asked. That's way better thank cookies, and just as transparent.

What am I missing? It would just take one browser (such as Chrome or Firefox) to support it and I think it would take off.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#18
post #15

This looks wide open to csrf attacks. Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user. Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".

Rails has CSRF protections baked in; unless you explicitly turn it off, non-GET requests require a CSRF token associated with the user session to complete successfully.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#19
post #15

This looks wide open to csrf attacks. Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user. Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".

that has nothing to do with using a password or not to authenticate. anti-forgery tokens are the answer to csrf.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#20

I know I'm probably asking a stupid question, but why can't my browser adopt some variation of OAuth and automatically authenticate me everywhere, forever? Imagine if we never had to discuss sign-up forms anymore. Everyone has an identity built into the browser, no questions asked. That's way better thank cookies, and just as transparent. What am I missing? It would just take one browser (such as Chrome or Firefox) t…

http://hacks.mozilla.org/2011/07/introducing-browserid-easie...
Post reply on HN