3 ms·

I'm not wild for PWAs but your suggested web app flow sounds like failings in the authentication setup of the PWA and of LastPass rather than the failings of PW

by shrew 7y ago

I'm not wild for PWAs but your suggested web app flow sounds like failings in the authentication setup of the PWA and of LastPass rather than the failings of PWAs in general. If a native app can remain authenticated with whatever service it communicates with a PWA should be able to as well, that's an implementation issue rather than a PWA issue, no? Similarly if LastPass doesn't integrate correctly to the point where you're having to manually look up details rather than having details auto-filled across websites and apps (iOS and Android both support this), that sounds like an issue with LastPass. With all that said, it's hard to deny that it's easier to keep a mobile app performant and flexible than it is a PWA. I'd also add to your list that native apps have familiar UIs by default, which is tricky to replicate in a PWA.

illuminati1911 7y ago
"If a native app can remain authenticated with whatever service it communicates with a PWA should be able to as well, that's an implementation issue rather than a PWA issue, no?" Native apps don't usually remain authenticated, but they'll allow you to store your credentials on the device keychain or secure enclave and it can be accessed with FaceID/TouchID making re-authentication completely automatic. "Similarly if LastPass doesn't integrate correctly to the point where you're having to manually look up details rather than having details auto-filled across websites and apps (iOS and Android both support this), that sounds like an issue with LastPass." We can surely blame the services, apps, browsers for not doing things correctly, but as an user I just want things to be fast, efficient and simple. Right now only native apps provide that experience. "(iOS and Android both support this)" Can you tell me how? I use Firefox, Chrome and Brave on iOS and have never seen any kind of Lastpass integration on them.
- shrew 7y ago
  "Native apps don't usually remain authenticated" Thanks for the correction, I admit I have limited knowledge of production ready native app development! As with the UI issue, a PWA developer could still use the JS crypto APIs to roll their own secure store for credentials, or store something similar to an API key issued on successful authentication? Handling this kind of data correctly has a lot of pitfalls, which is likely why most PWAs still use standard authentication processes. There are APIs and specs [0] [1] [2] that have been floating about for at least the last couple of years which aim to solve credential and authentication management in a more formal way in the browser, but as with many of these features, they're slower moving than the native SDKs. I still don't believe that makes it impossible to achieve a similar flow in a PWA but I certainly concede it's much harder to get right (secure and convenient). "Can you tell me how?" As a disclaimer, I jumped ship to 1Password before I jumped ship to iOS, so I've never actually done this with LastPass. But this article[3] appears to offer a similar experience to what I have with 1Password: - I go to an app or website - A prompt above the keyboard offers to autofill with credentials - I tap it and authenticate with 1Password (it normally pre-filters the list by app or website I'm using) - When I make a selection it autofills everything it can In 1Password, there is also the option to keep your OTP seed stored too, in which case it will copy the OTP to your clipboard for a short time (and slightly invalidate the purpose of 2FA...). [0] https://news.ycombinator.com/item?id=16801858 https://news.ycombinator.com/item?id=16801858 [1] https://github.com/WebKit/explainers/tree/master/IsLoggedIn https://github.com/WebKit/explainers/tree/master/IsLoggedIn [2] https://w3c.github.io/webappsec-credential-management/ https://w3c.github.io/webappsec-credential-management/ [3] https://blog.lastpass.com/2018/09/get-in-app-autofill-with-lastpass-ios-12.html/ https://blog.lastpass.com/2018/09/get-in-app-autofill-with-l...

by shrew 7y ago

illuminati1911 7y ago

"If a native app can remain authenticated with whatever service it communicates with a PWA should be able to as well, that's an implementation issue rather than a PWA issue, no?" Native apps don't usually remain authenticated, but they'll allow you to store your credentials on the device keychain or secure enclave and it can be accessed with FaceID/TouchID making re-authentication completely automatic. "Similarly if LastPass doesn't integrate correctly to the point where you're having to manually look up details rather than having details auto-filled across websites and apps (iOS and Android both support this), that sounds like an issue with LastPass." We can surely blame the services, apps, browsers for not doing things correctly, but as an user I just want things to be fast, efficient and simple. Right now only native apps provide that experience. "(iOS and Android both support this)" Can you tell me how? I use Firefox, Chrome and Brave on iOS and have never seen any kind of Lastpass integration on them.

shrew 7y ago
"Native apps don't usually remain authenticated" Thanks for the correction, I admit I have limited knowledge of production ready native app development! As with the UI issue, a PWA developer could still use the JS crypto APIs to roll their own secure store for credentials, or store something similar to an API key issued on successful authentication? Handling this kind of data correctly has a lot of pitfalls, which is likely why most PWAs still use standard authentication processes. There are APIs and specs [0] [1] [2] that have been floating about for at least the last couple of years which aim to solve credential and authentication management in a more formal way in the browser, but as with many of these features, they're slower moving than the native SDKs. I still don't believe that makes it impossible to achieve a similar flow in a PWA but I certainly concede it's much harder to get right (secure and convenient). "Can you tell me how?" As a disclaimer, I jumped ship to 1Password before I jumped ship to iOS, so I've never actually done this with LastPass. But this article[3] appears to offer a similar experience to what I have with 1Password: - I go to an app or website - A prompt above the keyboard offers to autofill with credentials - I tap it and authenticate with 1Password (it normally pre-filters the list by app or website I'm using) - When I make a selection it autofills everything it can In 1Password, there is also the option to keep your OTP seed stored too, in which case it will copy the OTP to your clipboard for a short time (and slightly invalidate the purpose of 2FA...). [0] https://news.ycombinator.com/item?id=16801858 https://news.ycombinator.com/item?id=16801858 [1] https://github.com/WebKit/explainers/tree/master/IsLoggedIn https://github.com/WebKit/explainers/tree/master/IsLoggedIn [2] https://w3c.github.io/webappsec-credential-management/ https://w3c.github.io/webappsec-credential-management/ [3] https://blog.lastpass.com/2018/09/get-in-app-autofill-with-lastpass-ios-12.html/ https://blog.lastpass.com/2018/09/get-in-app-autofill-with-l...