Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Craigslist Did Right: User Management Without Usernames or Passwords

jobpoacher.com

Post reply on HN
Print view View original

31–35 of 35 posts

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#31

Post by aerique »

drostie wrote: post #6

"These days, disabling your cookies would make it nearly impossible to use any web application. I’m not sure if people are still out there browsing the web with disabled cookies, but if you are, my hat’s off to you! :)" I use Firefox + Cookie Monster, which allows me to enable temporary cookies for the sites that I'm just browsing and permanent cookies for my webmail and social networking sites. The only site which s…

I've been browsing since forever with JavaScript and cookies disabled and with a middle-man (NoScript in my case) to selectively enable cookies for sites that are worth it, it is no problem.

I cringe using other people's browsers that do not block ads and javascript. Some sites that I thought weren't that bad turn into hideous ad-monsters.

Over the years the web has gone from a peaceful landscape to Times Square.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#32

Post by getsat »

brador wrote: post #30
getsat wrote: post #27

Earlier quoted context omitted.

There's a way to get around the phone requirement, too. I've seen this as far back as 2010. You pay to post a fake job (something unskilled that will get a lot of applications) on a site like Simply Hired, Indeed, etc. Applicants come to your fake careers site. Applicants fill out the application for the non-existent job and are asked to input their phone number to verify their application. When they input their phon…

Wouldn't the phone call start with "Your craigslist code is..."?

Maybe they changed it for this very reason... I'm not sure. At the time, there was no indication that the call was from Craigslist. You were just read a code, twice, and then the other end automatically hung up.

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#33

Post by Fabimaru »

drostie wrote: post #6

"These days, disabling your cookies would make it nearly impossible to use any web application. I’m not sure if people are still out there browsing the web with disabled cookies, but if you are, my hat’s off to you! :)" I use Firefox + Cookie Monster, which allows me to enable temporary cookies for the sites that I'm just browsing and permanent cookies for my webmail and social networking sites. The only site which s…

If it's too complicated with Cookie Monster, I open another browser (my trash browser, I use it for sites requiring Flash).

Re: What Craigslist Did Right: User Management Without Usernames or Passwords

#35

Post by joevandyk »

scriby wrote: post #15

This looks wide open to csrf attacks. Another site can post a form on behalf of a user automatically, and the cookies for job poacher will be sent. Meaning that a malicious site can take actions on behalf of a logged in user. Perhaps their solution is more complicated than they let on, but I doubt it given it's "20 lines of code".

This is why you check for tokens in the form that correspond to the current user's session. Rails does this for you automatically.
Post reply on HN