7 ms·

A smart use of "save password" is where you authenticate and store the login token locally. You can then log in without a password, but also your session can be

A smart use of "save password" is where you authenticate and store the login token locally. You can then log in without a password, but also your session can be invalidated any time you say... change your password, or ask for a session to be kicked off. We have to do this with web apps all the time. Nobody stores passwords in local browser store.

Someone1234 7y ago
I don't know if that applies to TV's circumstances because you can use the client to connect to endpoints without either end being internet accessible. TeamViewer does operate account infrastructure like you're describing, but that isn't exclusively what they offer. They do point-to-point too.
- NieDzejkob 7y ago
  I don't see how network position relates to the authentication scheme. As far as I can see, these are entirely separate issues, handled at different layers of the OSI stack.
- Nullabillity 7y ago
  The TV host could issue its own persistent tokens, no internet access required.
- signal11 7y ago
  Yes, looking at this page it’s possible to disconnect the client from Team Viewer’s online infrastructure entirely: https://community.teamviewer.com/t5/Knowledge-Base/Can-TeamViewer-be-used-within-a-local-network-LAN-only/ta-p/4618 https://community.teamviewer.com/t5/Knowledge-Base/Can-TeamV... > Hint: If you choose Accept exclusively, TeamViewer will disconnect from the internet – that means it will no longer be possible to make or receive connections using the TeamViewer ID, and the Computer & Contacts list will no longer be available.
gowld 7y ago
> Nobody stores passwords in local browser store. Yes, quite many body do: chrome://settings/passwords
- simongg 7y ago
  He's talking about web apps
  - shawnz 7y ago
    And TeamViewer isn't a web app. The parent is just demonstrating how other local, non-web apps have exactly the same issue for the same reason
    - cy6erlion 7y ago
      deep tangle
stefan_ 7y ago
That's a cool idea for a web service where once someone tries to actually change something, you can ask again for the password. I struggle to see how it makes any sort of difference for a remote management software; it's essentially an enterprise ready trojan. The moment someone has connected to a machine through token or password, that machine is utterly compromised and can not be saved by you clicking "revoke" in a web interface. That kinda situation calls for you to physically disconnect the machine from power.
crtlaltdel 7y ago
^this. i recently had to explain this to a product manager who wanted the user's email and password to be autofilled it they landed at the login page.
- cpach 7y ago
  I’ve actually seen that functionality in the wild. Quite horrible. IIRC it was some weird open source web app.
- nwsm 7y ago
  It's not the same thing at all. TeamViewer literally has to take in the password and paste it plaintext in later. They cannot simply validate that a user knows the password. This does not happen "all the time" in web dev.

Someone1234 7y ago

I don't know if that applies to TV's circumstances because you can use the client to connect to endpoints without either end being internet accessible. TeamViewer does operate account infrastructure like you're describing, but that isn't exclusively what they offer. They do point-to-point too.

NieDzejkob 7y ago
I don't see how network position relates to the authentication scheme. As far as I can see, these are entirely separate issues, handled at different layers of the OSI stack.
Nullabillity 7y ago
The TV host could issue its own persistent tokens, no internet access required.
signal11 7y ago
Yes, looking at this page it’s possible to disconnect the client from Team Viewer’s online infrastructure entirely: https://community.teamviewer.com/t5/Knowledge-Base/Can-TeamViewer-be-used-within-a-local-network-LAN-only/ta-p/4618 https://community.teamviewer.com/t5/Knowledge-Base/Can-TeamV... > Hint: If you choose Accept exclusively, TeamViewer will disconnect from the internet – that means it will no longer be possible to make or receive connections using the TeamViewer ID, and the Computer & Contacts list will no longer be available.

gowld 7y ago

> Nobody stores passwords in local browser store. Yes, quite many body do: chrome://settings/passwords

simongg 7y ago
He's talking about web apps
- shawnz 7y ago
  And TeamViewer isn't a web app. The parent is just demonstrating how other local, non-web apps have exactly the same issue for the same reason
  - cy6erlion 7y ago
    deep tangle

stefan_ 7y ago

That's a cool idea for a web service where once someone tries to actually change something, you can ask again for the password. I struggle to see how it makes any sort of difference for a remote management software; it's essentially an enterprise ready trojan. The moment someone has connected to a machine through token or password, that machine is utterly compromised and can not be saved by you clicking "revoke" in a web interface. That kinda situation calls for you to physically disconnect the machine from power.

crtlaltdel 7y ago

^this. i recently had to explain this to a product manager who wanted the user's email and password to be autofilled it they landed at the login page.

cpach 7y ago
I’ve actually seen that functionality in the wild. Quite horrible. IIRC it was some weird open source web app.
nwsm 7y ago
It's not the same thing at all. TeamViewer literally has to take in the password and paste it plaintext in later. They cannot simply validate that a user knows the password. This does not happen "all the time" in web dev.