I haven't made any attempt to test it, but they probably block using VOIP and other non-fixed phone numbers too. There are APIs available to check whether a number is one of those types, so, say, you can't sign up for a bunch of numbers through Twilio and use those to spam Craigslist.
What Craigslist Did Right: User Management Without Usernames or Passwords
11–20 of 35 posts
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#12"These days, disabling your cookies would make it nearly impossible to use any web application. I’m not sure if people are still out there browsing the web with disabled cookies, but if you are, my hat’s off to you! :)" I use Firefox + Cookie Monster, which allows me to enable temporary cookies for the sites that I'm just browsing and permanent cookies for my webmail and social networking sites. The only site which s…
I just visited their site again, I'm not exactly sure what they are using now, it does look good, but my god is it slow on my low end machine.
I am not surprised to hear they are needlessly complicating session tracking as well.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#13I like that the author thought through what the minimum amount of code needed would be to get the job done for his specific case. However with recent improvements to Rails, Authlogic & Devise are usually overkill even if you are going the standard route. It's easier than you think to roll your own, and you'll end up with a similar amount of code. Here's a good post summing it up: http://www.farbeyondprogramming.com/2011/05/63-rails-user-au...
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#14Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#15Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user.
Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#16An email is a unique field anyway, so when you say that "nobody likes creating a new username and password for a website" you are making the process sound more complicated than it really is. For the case of this site, the only difference is whether or not a password is required to log in. Additionally, should you want to add user-specific functionality later that persists across sessions, you will have to add an authentication system.
Again, that's not to say that this method is right or wrong, but I myself have started down the road of maintaining sessions with cookies instead of full-blown authentication, and every time I have ended up going back to authentication because I always end up deciding that the benefits outweigh the drawbacks.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#17What am I missing? It would just take one browser (such as Chrome or Firefox) to support it and I think it would take off.
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#18This looks wide open to csrf attacks. Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user. Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#19This looks wide open to csrf attacks. Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user. Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".
Re: What Craigslist Did Right: User Management Without Usernames or Passwords
#20I know I'm probably asking a stupid question, but why can't my browser adopt some variation of OAuth and automatically authenticate me everywhere, forever? Imagine if we never had to discuss sign-up forms anymore. Everyone has an identity built into the browser, no questions asked. That's way better thank cookies, and just as transparent. What am I missing? It would just take one browser (such as Chrome or Firefox) t…