3 ms·
It's worth pointing out that in this particular case, some people will have created their Last.fm accounts more or less solely for use with Audioscrobbler, a pr
by camtarn 10y ago
It's worth pointing out that in this particular case, some people will have created their Last.fm accounts more or less solely for use with Audioscrobbler, a protocol which allows them to track music listens through various third-party music players.
The important bit about that is that the Last.fm/Audioscrobbler account credentials get typed directly into the third-party players - usually there's no browser involved in authentication, and in some cases the players will also be on a mobile device.
There's a definite incentive for passwords to be simple (if you're going to type them in on a mobile keyboard) and weak (because it's just music metadata).
So, a 'magic link' style of logging in might work here, but it would have to be complemented by an easy way of generating auth tokens for player apps - for instance, short one-time-use codes that expire quickly.
- flushandforget 10y agoI wrote a simple web app to work with last.fm's api. A little fiddly, but in essense it worked. Somewhere buried in settings were all the apps that have access to my account. I then went back to Spotify and noticed it wanted my username and password. And ever since, I just haven't been bothered. I'd rather some throwaway autogenerated app linking passwords and authenticating consistency. Copying and pasting links isn't that hard. Go to last.fm, generate OTP token/link, paste into Spotify. Done. I should have some easy way to identify authenticated apps under my account and kick them out, or reset all. Not all of us use Web mail. And I might not want a link automagically opened there and then, under a browser.