This exact system was just on the front page last week.
Just use BrowserID.
A bold but simple login system
71–80 of 101 posts
Re: A bold but simple login system
#72Am I crazy in thinking that this whole problem should have been solved a long time ago by making password management a responsibility of the browser, either by baking it in or mediating the exchange? Combined with a simple standard for credential exchange (get request to example.com/login to get the list of required fields, post to https://example.com/login to login. Or more likely, some existing standard that handle…
Check out Mozilla Persona (used to be called BrowserID). https://login.persona.org/about
Yes, I remember that.
Ugly solution that didn't expose a UI for sites that didn't support it and still had plain username/password forms. So it's completely impossible to bootstrap this by making some of the features useful to browser users before it was widespread.
Needed a js library because it worked at the wrong level of abstraction and put browserid.org in the middle of the transaction for no sensible reason (well no sensible technical reason but a perfectly sensible political one).
This was not developed by someone thinking "how can we solve a problem our users have" but by someone thinking "it would be advantageous to be in the middle of login transactions and there is a user problem we could bolt that functionality on to".
Re: A bold but simple login system
#73Apple should augment a single sign-in mechanism with a transparent 2nd factor embodied in the iPhone. This would result in your being automatically logged into any participating site while using Safari on the same LAN as your iPhone. The mechanism would fall back to the traditional password if you don't have the phone. Bluetooth could also be used to communicate to the hardware. The hardware would only run signed App…
Google already does this with Chrome and Google websites.
I don't have to enter my second factor with credential or even my password when using Gmail from my phone, tablet, laptop or desktop.
Re: A bold but simple login system
#74I definitely find this topic interesting and have a hard time remembering all my passwords, but I'm not fan of this solution. Honestly, how isn't this just a worse implementation of OAuth? It seems equivalent to clicking a "login via gmail" button, except with more of a lag?
The main other difference I can see is that one button actually functions as "login via gmail, hotmail, yahoo mail, or any other countless email providers", and no work needs to happen on the email provider's end to make it work. Lots of people don't want to sign up for FB or Twitter, but basically everyone has an email account.
Re: A bold but simple login system
#75Earlier quoted context omitted.
The idea here is you only need to log in on a device once (or as often as you delete all your cookies). After that the site would remember you, so there really wouldn't be that much waiting on emails to arrive. Definitely not something I would want for my bank account, but who cares for logging on to a support forum or some other trivial account.
So why not just make the session last forever the same way, but using a password instead of requiring me to login to my email and click a link? I logged into Facebook the first time and as long as I didn't delete cookies, I could go to Facebook on that device today, tomorrow, next week, next month, next year... And never have to put my password in again. This just adds more waste...
Some people despise Facebook, but nearly everyone online has an email account.
Personally I would implement Facebook connect and have this email login system as an alternative.
Re: A bold but simple login system
#76Earlier quoted context omitted.
So why not just make the session last forever the same way, but using a password instead of requiring me to login to my email and click a link? I logged into Facebook the first time and as long as I didn't delete cookies, I could go to Facebook on that device today, tomorrow, next week, next month, next year... And never have to put my password in again. This just adds more waste...
Some people despise Facebook, but nearly everyone online has an email account. Personally I would implement Facebook connect and have this email login system as an alternative.
Not really saying Facebook, but using Facebook as an example. They keep the session alive until you either delete the cookie, or the session from your control panel. Why deal with this email method when you can just keep the session alive forever unless they logout or delete cookies, after they have typed their password in?
Re: A bold but simple login system
#77On OpenRent [1] we're using the Google Identity Toolkit [2]. We're finding that in our current configuration it works extremely well, even for non technical users. It offers password-less log-in, and also remembers your username/email client-side. The only issue is lack of support for facebook/twitter log in out of the box - but that is apparently in development. It doesn't seem to be widely adopted, and that is poss…
Great site! Sadly I got an error trying to log in with Google.
Re: A bold but simple login system
#78This would drive me up the wall. I don't want to have to sit in my mail client, waiting for it to pull down the message that may-or-may-not have arrived at my mail host yet, when it's incredibly easy to use a password manager for everything without having to leave my browser. He bemoans the number of controls you need to interact with to log in, but to get to log in with his method, I need to put in my email address…
First thing I thought too. The email validation step, in my opinion, is the most annoying part of signing up for any site. I often log in places on devices where I don't have access to my email, so this requirement would completely keep me off your site.
Re: A bold but simple login system
#79On OpenRent [1] we're using the Google Identity Toolkit [2]. We're finding that in our current configuration it works extremely well, even for non technical users. It offers password-less log-in, and also remembers your username/email client-side. The only issue is lack of support for facebook/twitter log in out of the box - but that is apparently in development. It doesn't seem to be widely adopted, and that is poss…
Great site! Sadly I got an error trying to log in with Google.
Ouch - I don't seem to be able to reproduce it but we'll take a look. Do you mind emailing me on [redacted] to discuss?
Re: A bold but simple login system
#80I have a text document on my computer that lists all the websites/programs with username/password. I also use autocomplete (which IMO is basically the same as having a document with all passwords.) I can have unique passwords for every single website without relying on a third party cloud solution. And for the passwords I use often, I have them memorized anyway.
If something is compromised (which has happened) then I have a list of every single site where I have an account, and can change the passwords.
A side benefit to this is if someone needs to access something (most likely while traveling, or if I'm dead) all the information is there for them.