3 ms·

>But web app must be working, just press Cancel if app is not installed. I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I t

by danjoc 9y ago

>But web app must be working, just press Cancel if app is not installed. I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I thought your main selling point was usability. >Everyone in the world knows auth is broken. Auth is broken when you have a HIPAA breach. Try explaining how convenience fits in there to someone deciding if you've been negligent. It can mean the difference between prison and no prison. >Necessary evil? The current onboard process hurts conversion, so that's a disaster. Instead, we ask users to download an app, which they don't[1], it hurts conversion, and that's a necessary evil. A rose by any other name... >There's no reason for this to happen Maybe not today. Apple has the power to put any developer on their platform out of business, overnight. Apple could decide to amend their "Application may not download or install executable code" clause to include JS apps that it didn't before. They've wiped out huge swathes of apps in the past. If auth is down, the app/service is down. I'd hate to have a large portion of my customer base wiped out permanently by a policy change at Apple. [1] https://www.recode.net/2016/6/8/11883518/app-boom-over-snapchat-uber https://www.recode.net/2016/6/8/11883518/app-boom-over-snapc...

homakov 9y ago
>I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I thought your main selling point was usability. To be precise that depends on client implementation, we will use a popup that doesn't even redirect anywhere. [1] - exactly my thoughts. Web is a good way to go, but the apps are what many security-minded folks require, so it's both. > Apple could decide to amend their "Application may not download or install executable code" clause to include JS apps that it didn't before I kind of support that anti Unrollme policy. They could outlaw all Cordova apps, but that would be a disaster. It makes me think to make going back to web app easier, will look for a way.
- danjoc 9y ago
  >will look for a way It's definitely not an easy problem. I hope I haven't come off as too harsh. Client certificates would be great. I think you write off the value of hardware tokens too quickly, but by all means, look at other ways. Auth is one of the first things any of us have to do when putting together a service. This is something a lot of us have studied for a long time. Welcome to the party :)

by danjoc 9y ago

homakov 9y ago

>I want to try your thing, so I press cancel? That doesn't seem terribly intuitive. I thought your main selling point was usability. To be precise that depends on client implementation, we will use a popup that doesn't even redirect anywhere. [1] - exactly my thoughts. Web is a good way to go, but the apps are what many security-minded folks require, so it's both. > Apple could decide to amend their "Application may not download or install executable code" clause to include JS apps that it didn't before I kind of support that anti Unrollme policy. They could outlaw all Cordova apps, but that would be a disaster. It makes me think to make going back to web app easier, will look for a way.

danjoc 9y ago
>will look for a way It's definitely not an easy problem. I hope I haven't come off as too harsh. Client certificates would be great. I think you write off the value of hardware tokens too quickly, but by all means, look at other ways. Auth is one of the first things any of us have to do when putting together a service. This is something a lot of us have studied for a long time. Welcome to the party :)