Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A bold but simple login system

notes.xoxco.com

Post reply on HN
Print view View original

81–90 of 101 posts

Re: A bold but simple login system

#81

Post by natrius »

freshhawk wrote: post #72
superkarn wrote: post #67

Earlier quoted context omitted.

Check out Mozilla Persona (used to be called BrowserID). https://login.persona.org/about

Yes, I remember that. Ugly solution that didn't expose a UI for sites that didn't support it and still had plain username/password forms. So it's completely impossible to bootstrap this by making some of the features useful to browser users before it was widespread. Needed a js library because it worked at the wrong level of abstraction and put browserid.org in the middle of the transaction for no sensible reason (we…

The persona.org middleman is only used when your email provider doesn't support BrowserID. It is temporary.

It is useful to browser users today. You don't have to remember a new password for each site or become less secure by giving the same password out to multiple sites. I'm going to use it on the next site I build.

Re: A bold but simple login system

#82

Post by uptown »

kbatten wrote: post #80

I have a text document on my computer that lists all the websites/programs with username/password. I also use autocomplete (which IMO is basically the same as having a document with all passwords.) I can have unique passwords for every single website without relying on a third party cloud solution. And for the passwords I use often, I have them memorized anyway. If something is compromised (which has happened) then I…

What if the thing that is compromised is the computer with the text file?

Re: A bold but simple login system

#83

Post by javajosh »

drcube wrote: post #70

Outside of transfering money, I think you should structure your site so that logins are not necessary. For example, if I wasn't the only "drcube" on Hacker News, I wouldn't be upset. Names in meat space aren't unique, why should we expect them to be on the web? Next time you think about starting a web service (that doesn't handle money!), think about what you lose by getting rid of user accounts entirely. It probably…

> think about what you lose by getting rid of user accounts entirely. It probably isn't much.

This gets to the heart of identity! It often doesn't matter. For example, one could clone HN using anonymous accounts. You'd give up only karma and connection between messages. It would be, essentially, something like usenet where you have a choice to "brand" every message you send with an identity - or not. Let's call this "Broadcast Identity".

Then there is something else which is your "Legal Identity" and it's the one most closely associated with all things money. It's the one that you need to deal with financial obligation, going in both directions. When you buy something, you want it to come to you, not to some one else.

Interestingly, I don't think that targeted ads really care about the connection between Broadcast and Legal identity. This implies that, no, you probably won't lose much by losing user accounts.

Actually, I take that back. The one thing that sites want and need is a way to proactively contact you. Aha! I think I just stumbled on the real reason we keep logins around - to get the email address, so we can send newsletters, reminders, etc. To prod the user into using our service more. To remind them that we exist, to be obtrusive, because our value isn't intrinsically strong enough to remind them.

Re: A bold but simple login system

#84

Post by natrius »

kbatten wrote: post #80

I have a text document on my computer that lists all the websites/programs with username/password. I also use autocomplete (which IMO is basically the same as having a document with all passwords.) I can have unique passwords for every single website without relying on a third party cloud solution. And for the passwords I use often, I have them memorized anyway. If something is compromised (which has happened) then I…

How is your solution better than a third-party cloud solution?

Re: A bold but simple login system

#85

Post by uptown »

A way to streamline this even further might be to pair it with a browser extension designed to poll your inbox for these specific messages. When received, the extension could handle the login step, eliminating the need for the user to jump to their inbox for the validation email. I'm not sure if that kind of extension could be created so that it didn't compromise the security of your inbox.

Re: A bold but simple login system

#88

Post by mandeepj »

I also felt login process should be simplified. I got two types of registration forms at my new website (www.survenator.com) - one is express where user only enters their email address and a highly secured password is email to them. Other is the complete registration form. Although the form is still kept very short. Users can change their passwords\other account information anytime.

Express registration may work for well for those who have hard time coming up with strong passwords or don't want to think about a password while doing another new registration. We started this feature as an experiment and will evolve\refine it based upon the usage.

Once the user confirms their account if they selected "remember me" checkbox then we don't require them to login, we just check for authentication cookie.

I do not agree with the author regarding his vision for "password reset tool feature to send the link in the email". Sometimes users want to take control of their password and do not want to remembered for security reasons.

Re: A bold but simple login system

#89

Post by natrius »

drivebyacct2 wrote: post #73
stcredzero wrote: post #40

Apple should augment a single sign-in mechanism with a transparent 2nd factor embodied in the iPhone. This would result in your being automatically logged into any participating site while using Safari on the same LAN as your iPhone. The mechanism would fall back to the traditional password if you don't have the phone. Bluetooth could also be used to communicate to the hardware. The hardware would only run signed App…

Google already does this with Chrome and Google websites. I don't have to enter my second factor with credential or even my password when using Gmail from my phone, tablet, laptop or desktop.

At this point, I actively seek out Google account login options. It is so incredibly pleasant to use on Android.

Re: A bold but simple login system

#90

Post by nsmartt »

natrius wrote: post #84
kbatten wrote: post #80

I have a text document on my computer that lists all the websites/programs with username/password. I also use autocomplete (which IMO is basically the same as having a document with all passwords.) I can have unique passwords for every single website without relying on a third party cloud solution. And for the passwords I use often, I have them memorized anyway. If something is compromised (which has happened) then I…

How is your solution better than a third-party cloud solution?

One obvious benefit is that you aren't trusting anyone else with your passwords.
Post reply on HN