4 ms·

Totally agree OAuth sucks. Want a simple way forward? https://passwordless.net/ https://passwordless.net/ For profile info: https://en.gravatar.com/ https://e

Totally agree OAuth sucks. Want a simple way forward? https://passwordless.net/ https://passwordless.net/ For profile info: https://en.gravatar.com/ https://en.gravatar.com/ Why do you need someone to sign in with their third party service account? If it's just because you want a low friction sign up / sign in think again, it is not low friction. If its to prevent from having yet another account and password? This could be a great option. With OAuth There is a lot of friction on the flow and privacy concerns. "What kind of data are they going to suck out of my account?" Last time I looked at OAuth years ago I had huge reservations. In mobile apps it uses a web-view in the middle of the flow. Is that web-view logging my key presses? Is it using HTTPS? Is the cert good? You'll never know. I ran some of these concerns by Eran Hammer (brilliant, great guy) and he had no great consolation to give me. Not long after came his epic departure from OAuth (Not implying any correlation.) I went on to "invent" a new auth system for mobile based on push notifications. I got mired in trying to patent this and realized that was stupid. TL;DR of that project, push notifications are an amazingly secure and targeted way to deliver auth tokens try it out! But in the end, nothing beats the simplicity of letting go and just going with passwordless and gravatar IMHO.

pfooti 11y ago
I dunno - I get the privacy concerns, sure. But passwordless requires the user have an email address to receive the nonce, and it requires the developer to deal with that flow. It also requires transactional email, which can be laggy at times - I know sometimes (rarely, but not never) my mandrill outbounds can take minutes to actually resolve. If I'm sitting waiting for a login token to get to my emails and it's not Right There, I'm walking. I don't see passwordless fixing anything new that OAuth doesn't fix. Use the basic profile grant, and the user sees the consent screen where you're just asking for a small grant. Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche.
- lootsauce 11y ago
  Sure, lag could be a problem with some email providers, but you are not limited to email. From the site: "Deliver your tokens via email, text messages (SMS), or smoke signs. You can embed Sendgrid, emailjs, Twilio, or any other framework you like to get the token to your user."
- callahad 11y ago
  > Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche. You're making a flawed assumption that just because a major email provider offers OAuth, that websites themselves will also integrate with that OAuth provider. Yahoo Mail supports OAuth, but that's not worth a damn if sites don't explicitly integrate with Yahoo and provide a "Sign in with Yahoo" button. That's why we need email-based authentication. Because, in practice, sites are going to integrate with Gmail and Facebook and call it a day. (On the flipside, there's a great opportunity for Passwordless to offer optional, transparent integration with major OAuth providers, while falling back to an email loop for everyone else so people don't get locked out. That's what we did for Persona, and it mostly worked wonderfully.)
  - aianus 11y ago
    > That's why we need email-based authentication. Because, in practice, sites are going to integrate with Gmail and Facebook and call it a day. So what? That covers like 95% of web users right there and if some users don't like it they can go through the full signup flow.
    - dreamfactory2 11y ago
      That's a very Western centred view. We really seem to be losing sight of the internet as a global shared infrastructure, which was the point of the whole thing and where the benefits have come from. On the present course we might as well be going back to the arid experiences of fido and minitel.
  - pfooti 11y ago
    > You're making a flawed assumption that just because a major email provider offers OAuth, that websites themselves will also integrate with that OAuth provider. Yahoo Mail supports OAuth, but that's not worth a damn if sites don't explicitly integrate with Yahoo and provide a "Sign in with Yahoo" button. I'm not really sure I buy this premise. As a developer, it's my job to provide login options. I'm 100% on board with not providing a username / password option unless my bosses demand it and ignore my counterarguments. But I fail to see how the passwordless model is not just an equivalent case with using lots of OAuth2 plugins. It's a neat system, don't get me wrong. I could see using it in addition to a typical suite of OAuth providers. But I don't see it as a drop-in, solve-everything replacement for OAuth2. It's really just a (node / express) library that approaches the same problems but exposes different implementation issues instead.
- josteink 11y ago
  > Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche. Eh. Screw company emails eh?
  - shaftway 11y ago
    https://accounts.google.com/SignUpWithoutGmail https://accounts.google.com/SignUpWithoutGmail
LoSboccacc 11y ago
yeah one time passwords have been around for ages, guess why website don't use them? because users hate those. only banks got around it so far, and because they made the process hassle free giving out hardware tokens. waiting for a sms confirmation sucks as a user experience and you can't guarantee fast delivery (or that the user has signal at all the time)
- Shorel 11y ago
  Is not that the same as the Steam Guard? There are millions of gamers using it.
aianus 11y ago
> If it's just because you want a low friction sign up / sign in think again, it is not low friction. Highly disagree. Click "Login with Facebook" -> "Oh look they just want my name and email" -> Accept ^ That's 90% of my Facebook signups; it's much easier than entering everything from scratch and then verifying my email. If your app just needs name/email/password and has no significant privacy or financial implications, for the love of god allow Facebook signups.
- silverbax88 11y ago
  People should never, ever be using their Facebook logins to sign in to other applications, and developers have a responsibility not to allow that to proliferate. I wouldn't use Facebook creds to log into any application, so I sure wouldn't push that on users who don't know better.
  - aianus 11y ago
    Because? Why should I spend 2 minutes creating an account for, say, 9GAG, instead of signing in with FB with one click? Why is 9GAG irresponsible for offering me that option?
    - silverbax88 11y ago
      Yes, because now they are allowing a third party to track you. You may be fine with it, but most users are not aware that FB is tracking them everywhere AND that their credentials are being handed off across a third party. Never, ever do this. We rail about banks and credit firms handing off our data but are apparently perfectly fine with handing off our users data without their knowledge to a firm with known privacy issues.
  - philh 11y ago
    Apparently, I'm a user who doesn't know better. Thank you for taking the time to condescend to me.
    - 11y ago

pfooti 11y ago

I dunno - I get the privacy concerns, sure. But passwordless requires the user have an email address to receive the nonce, and it requires the developer to deal with that flow. It also requires transactional email, which can be laggy at times - I know sometimes (rarely, but not never) my mandrill outbounds can take minutes to actually resolve. If I'm sitting waiting for a login token to get to my emails and it's not Right There, I'm walking. I don't see passwordless fixing anything new that OAuth doesn't fix. Use the basic profile grant, and the user sees the consent screen where you're just asking for a small grant. Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche.

lootsauce 11y ago
Sure, lag could be a problem with some email providers, but you are not limited to email. From the site: "Deliver your tokens via email, text messages (SMS), or smoke signs. You can embed Sendgrid, emailjs, Twilio, or any other framework you like to get the token to your user."
callahad 11y ago
> Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche. You're making a flawed assumption that just because a major email provider offers OAuth, that websites themselves will also integrate with that OAuth provider. Yahoo Mail supports OAuth, but that's not worth a damn if sites don't explicitly integrate with Yahoo and provide a "Sign in with Yahoo" button. That's why we need email-based authentication. Because, in practice, sites are going to integrate with Gmail and Facebook and call it a day. (On the flipside, there's a great opportunity for Passwordless to offer optional, transparent integration with major OAuth providers, while falling back to an email loop for everyone else so people don't get locked out. That's what we did for Persona, and it mostly worked wonderfully.)
- aianus 11y ago
  > That's why we need email-based authentication. Because, in practice, sites are going to integrate with Gmail and Facebook and call it a day. So what? That covers like 95% of web users right there and if some users don't like it they can go through the full signup flow.
  - dreamfactory2 11y ago
    That's a very Western centred view. We really seem to be losing sight of the internet as a global shared infrastructure, which was the point of the whole thing and where the benefits have come from. On the present course we might as well be going back to the arid experiences of fido and minitel.
- pfooti 11y ago
  > You're making a flawed assumption that just because a major email provider offers OAuth, that websites themselves will also integrate with that OAuth provider. Yahoo Mail supports OAuth, but that's not worth a damn if sites don't explicitly integrate with Yahoo and provide a "Sign in with Yahoo" button. I'm not really sure I buy this premise. As a developer, it's my job to provide login options. I'm 100% on board with not providing a username / password option unless my bosses demand it and ignore my counterarguments. But I fail to see how the passwordless model is not just an equivalent case with using lots of OAuth2 plugins. It's a neat system, don't get me wrong. I could see using it in addition to a typical suite of OAuth providers. But I don't see it as a drop-in, solve-everything replacement for OAuth2. It's really just a (node / express) library that approaches the same problems but exposes different implementation issues instead.
josteink 11y ago
> Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche. Eh. Screw company emails eh?
- shaftway 11y ago
  https://accounts.google.com/SignUpWithoutGmail https://accounts.google.com/SignUpWithoutGmail

LoSboccacc 11y ago

yeah one time passwords have been around for ages, guess why website don't use them? because users hate those. only banks got around it so far, and because they made the process hassle free giving out hardware tokens. waiting for a sms confirmation sucks as a user experience and you can't guarantee fast delivery (or that the user has signal at all the time)

Shorel 11y ago
Is not that the same as the Steam Guard? There are millions of gamers using it.

aianus 11y ago

> If it's just because you want a low friction sign up / sign in think again, it is not low friction. Highly disagree. Click "Login with Facebook" -> "Oh look they just want my name and email" -> Accept ^ That's 90% of my Facebook signups; it's much easier than entering everything from scratch and then verifying my email. If your app just needs name/email/password and has no significant privacy or financial implications, for the love of god allow Facebook signups.

silverbax88 11y ago
People should never, ever be using their Facebook logins to sign in to other applications, and developers have a responsibility not to allow that to proliferate. I wouldn't use Facebook creds to log into any application, so I sure wouldn't push that on users who don't know better.
- aianus 11y ago
  Because? Why should I spend 2 minutes creating an account for, say, 9GAG, instead of signing in with FB with one click? Why is 9GAG irresponsible for offering me that option?
  - silverbax88 11y ago
    Yes, because now they are allowing a third party to track you. You may be fine with it, but most users are not aware that FB is tracking them everywhere AND that their credentials are being handed off across a third party. Never, ever do this. We rail about banks and credit firms handing off our data but are apparently perfectly fine with handing off our users data without their knowledge to a firm with known privacy issues.
- philh 11y ago
  Apparently, I'm a user who doesn't know better. Thank you for taking the time to condescend to me.
  - 11y ago