4 ms·

Great, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of

Great, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of accounts you’ve recently used so you can pick one and sign in—and enter a URL (or email) only if you need to.

EGreg 8y ago
The problem is, where do you store this list? The Web doesn’t have a way to store things except at a particular domain, and that domain will then know everything. Anyone remember xAuth effort led by Meebo and others? It ran into the same objections for using a centralized domain for the time being even though it was great.
- maxerickson 8y ago
  Browsers could implement that part of the UI. Like address autofill.
  - EGreg 8y ago
    And until then what do we do?
    - maxerickson 8y ago
      Cry in our beverages of choice.
    - lstamour 8y ago
      The existing AccountChooser interface, which was Google’s preferred SSO strategy until their recent experiments with zero-click SSO, was hosted at AccountChooser.com by the OpenID folks.
    - mblaney 8y ago
      I made a bookmarklet that will store a url for you, and sign you in. You can create your own at: https://unicyclic.com/usb https://unicyclic.com/usb
daveid 8y ago
Unless there's gonna be native browser support, the different websites you visit won't be able to know which accounts you've recently used elsewhere.
- dane-pgp 8y ago
  If browsers were to support this, there would be some tricky UI/UX questions about how readily the browser provides information to a new website about accounts you have on other sites. Such a feature might best be specified as an extension to this API: https://developer.mozilla.org/en-US/docs/Web/API/Credential_Management_API https://developer.mozilla.org/en-US/docs/Web/API/Credential_... which although experimental does have some level of browser support.
  - lwf 8y ago
    Don't expose it to the web page, but treat it as a native UI control.
  - dwaite 8y ago
    The web credential API is meant to be an integration point for passwords and AccountChooser in your browser. But I don't know if any other browsers than Chrome plan to implement it.
- lstamour 8y ago
  Unless you centralize the list as AccountChooser.com does using Local Storage.
dane-pgp 8y ago
You mention "URL (or email)", so I think it is worth pointing out that there is a standardized way of converting an email address into an HTTP URL, namely WebFinger. The RFC even includes an example of doing something very similar to this use case: https://tools.ietf.org/html/rfc7033#section-3.1 https://tools.ietf.org/html/rfc7033#section-3.1

EGreg 8y ago

The problem is, where do you store this list? The Web doesn’t have a way to store things except at a particular domain, and that domain will then know everything. Anyone remember xAuth effort led by Meebo and others? It ran into the same objections for using a centralized domain for the time being even though it was great.

maxerickson 8y ago
Browsers could implement that part of the UI. Like address autofill.
- EGreg 8y ago
  And until then what do we do?
  - maxerickson 8y ago
    Cry in our beverages of choice.
  - lstamour 8y ago
    The existing AccountChooser interface, which was Google’s preferred SSO strategy until their recent experiments with zero-click SSO, was hosted at AccountChooser.com by the OpenID folks.
  - mblaney 8y ago
    I made a bookmarklet that will store a url for you, and sign you in. You can create your own at: https://unicyclic.com/usb https://unicyclic.com/usb

daveid 8y ago

Unless there's gonna be native browser support, the different websites you visit won't be able to know which accounts you've recently used elsewhere.

dane-pgp 8y ago
If browsers were to support this, there would be some tricky UI/UX questions about how readily the browser provides information to a new website about accounts you have on other sites. Such a feature might best be specified as an extension to this API: https://developer.mozilla.org/en-US/docs/Web/API/Credential_Management_API https://developer.mozilla.org/en-US/docs/Web/API/Credential_... which although experimental does have some level of browser support.
- lwf 8y ago
  Don't expose it to the web page, but treat it as a native UI control.
- dwaite 8y ago
  The web credential API is meant to be an integration point for passwords and AccountChooser in your browser. But I don't know if any other browsers than Chrome plan to implement it.
lstamour 8y ago
Unless you centralize the list as AccountChooser.com does using Local Storage.

dane-pgp 8y ago

You mention "URL (or email)", so I think it is worth pointing out that there is a standardized way of converting an email address into an HTTP URL, namely WebFinger. The RFC even includes an example of doing something very similar to this use case: https://tools.ietf.org/html/rfc7033#section-3.1 https://tools.ietf.org/html/rfc7033#section-3.1