151–160 of 243 posts
Why can't they just focus on what people value them for, web browsers and privacy?
Earlier quoted context omitted.
Hey Michael! Aw :( Do you think these problems can be solved with an extension or a different protocol? How close were you to a solution for this?
The only thing that has a chance of happening is some external party coming up with a different protocol or extending the existing one, and gaining traction as an identity provider. Then, like we did with Pocket and "Save for Later", it's not unreasonable to think that Firefox would accept a system add-on that is compatible with this protocol to ship an in-browser UI. "gaining traction as an identity provider" being…
Earlier quoted context omitted.
What's the benefit? And, more than this, why do I must provide anyone my mail address? Why do I have to provide it at all? I understand and I'll provide my email address, my JID, my phone number and whatever else I'm willing to provide, if I want someone to contact me. But contact details are technically completely unnecessary to just have an account.
Password reset. Services need to identify you in another way to authenticate you that isn't your password. If you don't want that, use Mailinator and forget about it. It's insurance against stupid support requests is what it is.
Earlier quoted context omitted.
> but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". For me those big fat "sign in with google/facebook" buttons are an annoyance when it takes several clicks to get the old-fashioned account management. Some sites don't even have an option to not use a 3rd-party identity. Not everyone has google/facebook.
And more importantly, signing in with fb is simply handing over our personal details. I use gmail, I have no problem trading my info for goods and services - I know what they're realistically worth and judge accordingly. But for Fred's Arbitrary Website? Go fuck yourself Fred, I'll hand over exactly as much information as I like.
They'll add your new usage patterns to the database they've been building about you for the past decade. They'll correlate your behavior with other users of Fred's arbitrary website.
Earlier quoted context omitted.
> I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Why not just 'log in with email address'? The user provides his email address; you send him an email with a URL of the form http://www.invalid/path/to/resource?access_token=aSBkb25lIGF... (where aSBkb25lIGF1dGhlbnRpY2F0ZWQgdGhpcw is a cryptographicall…
"Why not just...?" I enjoy that you offer up a quite complex, confusing, often insecure, and error-prone methodology with this phrase.
Seriously, this sort of thing is not complex, not at all.
Earlier quoted context omitted.
I thought so too. But then people started forgetting their passwords, so i made email mandatory. People will rarely write down/take note of their password to a website that they "just want to check out".
If they just want to check your website out, why are you forcing them to choose a password anyway?
In fact, most of our app users don't even have to sign up! They are invited via sms or email, and given a link that works like a capability. Clicking that link established an account for them and they get a full experience right away, complete with all their followers (people who uploaded their address books and had their number or email in there).
This is instant engagement of the user.
We don't even require a password for when they download our native app. We just go to Safari and do an OAuth 2.0 flow with our own site and give an access token to the app. That access token can be for 100 years.
They only need a password when their cookie expires or if they want to access the site from another device.
In that case, it's good to have asked for the email address or phone number in the beginning. That's the user's identifier.
Our system also works with Facebook connect, etc. but that's not the coolest part. The coolest part is having the user choose their own Qbix app as the identity provider to authenticate with, so they can visit new sites and they are instantly greeted by name, find friends on there etc. without the site knowing anything about them on other sites. That's the holy grail :)
Earlier quoted context omitted.
Password reset. Services need to identify you in another way to authenticate you that isn't your password. If you don't want that, use Mailinator and forget about it. It's insurance against stupid support requests is what it is.
They don't need to identify me, they want to identify me. And throwaway emails are not a solution to the problem, they're just workarounds.