4 ms·
Just a thought on the auto-login functionality... If I run an intercepting proxy and alter all instances of my username in the HTML response from HN servers to
by zaroth 10y ago
Just a thought on the auto-login functionality...
If I run an intercepting proxy and alter all instances of my username in the HTML response from HN servers to appear in every way to be logged in as 'dang'....
How would your extension detect the forgery?
- todd3834 10y agoGlad you asked! So here is a teaser on how it works: 1. ClapChat gives you a unique id, the extension posts the id in your profile, ClapChat independently verifies that your profile contains the correct ID so that we know you really do own the account, then we double check the ID vs the session that we gave the id to and we can validate the authorization. I'm working on a blog post that goes into much further detail and will post soon.
- todd3834 10y agoIn a way, it's kind of like validating a domain name using a TXT record.
- JoeCortopassi 10y agoBtw, we also plan on open sourcing all this. So everyone will be able to give feedback and contribute. The hope is it becomes a really useful tool for the community
- truebosko 10y agoNeat. I remember my days on Something Awful Forums and many did the same thing for various integrations. Ten years later the technique still works.
- rokhayakebe 10y agoYou should offer HN Auth As a Service/Platform so that others can easily build around it and users can easily auth into others services.
- todd3834 10y agoHere is an early diagram I made when we were exploring the idea. It's not the complete story but hopefully it communicates the general idea https://s3-us-west-1.amazonaws.com/www.clap.chat/assets/HN-auth-diagram.png https://s3-us-west-1.amazonaws.com/www.clap.chat/assets/HN-a...