Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Craigslist Did Right: User Management Without Usernames or Passwords

jobpoacher.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#21

Post by notatoad »

alain94040 wrote: post #17

I know I'm probably asking a stupid question, but why can't my browser adopt some variation of OAuth and automatically authenticate me everywhere, forever? Imagine if we never had to discuss sign-up forms anymore. Everyone has an identity built into the browser, no questions asked. That's way better thank cookies, and just as transparent. What am I missing? It would just take one browser (such as Chrome or Firefox) t…

it's not quite as transparent, because your browser will prompt you to share your ID with the site whereas cookies just work without the user ever seeing a login form, but yes. browserID is a pretty cool concept and i hope to see it take off.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#22

Post by carmen »

dangrossman wrote: post #11

Craigslist has a big spam problem to deal with; anonymous e-mail based accounts make spamming very easy. They've dealt with this through phone verification -- if you try to post to a high-spam category, or your account is otherwise suspicious looking, you get prompted to enter a phone number and take an automated call or SMS with a code to put in the site. That phone number gets tied to your e-mail and can't be used…

ive been unable to get Craigslist's phone-token thing to call my VOIP DID without throwig errors. title there and here is misleading, i need a username/pasword to login to both VOIP and EMail accounts to fiddle with all of CL's post-approval stuff. it feels positively mid-90s

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#23

Post by scriby »

cheald wrote: post #18
scriby wrote: post #15

This looks wide open to csrf attacks. Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user. Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".

Rails has CSRF protections baked in; unless you explicitly turn it off, non-GET requests require a CSRF token associated with the user session to complete successfully.

That makes sense. I've been doing node js too long where you have to do this stuff by hand :0

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#24

Post by dedward »

the thing about https and your employer.... be very aware that on managed workstations, its trivial to intercept https traffic by pushing out a new trusted ca across the company....

assume your employer can see everything you are doing.

what are you doing job hunting on his dime anyway? uncool.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#25

Post by meric »

My website does this too - example: http://textbookcentral.com.au/26/university-of-new-south-wal...

It sends you a confirmation email which you must click on before your post is broadcast to other buyers and sellers.

I figured this beats user accounts because students buying / selling users would come here at most once per semester, they are never going to remember their account credentials anyway.

No spammers, yet. (the spammers post without confirming)

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#27

Post by getsat »

dangrossman wrote: post #11

Craigslist has a big spam problem to deal with; anonymous e-mail based accounts make spamming very easy. They've dealt with this through phone verification -- if you try to post to a high-spam category, or your account is otherwise suspicious looking, you get prompted to enter a phone number and take an automated call or SMS with a code to put in the site. That phone number gets tied to your e-mail and can't be used…

There's a way to get around the phone requirement, too. I've seen this as far back as 2010.

You pay to post a fake job (something unskilled that will get a lot of applications) on a site like Simply Hired, Indeed, etc. Applicants come to your fake careers site. Applicants fill out the application for the non-existent job and are asked to input their phone number to verify their application.

When they input their phone number, the backend of the careers site submits that number to Craigslist. The applicant receives the call from Craigslist which reads them a number. The careers site instructs them to enter the number to confirm their application.

A few days later your site auto-emails the applicant saying that you're sorry, but the position has been filled. They forget about it and no suspicion has been raised.

For the price of posting a single job, you can get hundreds of phone-verified Craigslist accounts working.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#28

Post by mcherm »

dedward wrote: post #24

the thing about https and your employer.... be very aware that on managed workstations, its trivial to intercept https traffic by pushing out a new trusted ca across the company.... assume your employer can see everything you are doing. what are you doing job hunting on his dime anyway? uncool.

Therefore when job hunting never use the browser your employer installed on your computer, always use one you installed yourself. Did I say job hunting? I meant checking your bank balance. Although if you don't trust your employer this much maybe you SHOULD be job hunting. Besides, they can always install a key logger.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#29

Post by dchest »

In our rails model, we generate a SHA1 string based off of the user’s email address, the random obfuscated email address that we generate, and a salt.

Why people still do this, when HMAC is even easier to use? http://www.ruby-doc.org/stdlib-1.9.3/libdoc/digest/rdoc/Dige...

It also seems like the salt here is not actually a salt, but a secret key.

Edit:

    @listing = Listing.find_by_confirmation_code(params[:code])
I'm confused. If you store confirmation code, and lookup users by it, why it should be SHA1 instead of a random string?

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#30

Post by brador »

getsat wrote: post #27
dangrossman wrote: post #11

Craigslist has a big spam problem to deal with; anonymous e-mail based accounts make spamming very easy. They've dealt with this through phone verification -- if you try to post to a high-spam category, or your account is otherwise suspicious looking, you get prompted to enter a phone number and take an automated call or SMS with a code to put in the site. That phone number gets tied to your e-mail and can't be used…

There's a way to get around the phone requirement, too. I've seen this as far back as 2010. You pay to post a fake job (something unskilled that will get a lot of applications) on a site like Simply Hired, Indeed, etc. Applicants come to your fake careers site. Applicants fill out the application for the non-existent job and are asked to input their phone number to verify their application. When they input their phon…

Wouldn't the phone call start with "Your craigslist code is..."?
Post reply on HN