12 ms·

Show HN: Login with HN (Unofficially)

436 points by hardwaresofton 5y ago

_v7gu 5y ago
Implementation idea: this method reminds me that we can post our public keys in bio, which means logging in could just mean signing a message that says "sign me in to %service%" and you wouldn't need to update your bio for each service you log in to
hardwaresofton 5y ago
Hey HN, I wanted to be able to make apps that do social login with HN so I hacked it together. It works like you would expect -- generating a code you can put in your profile. For convenience, you can then use either TOTP or Email (if you specify both, it will default to using TOTP) to login thereafter to make things quicker (it can take up to a minute until profiles update). I generally wait about 5 seconds between checks of a profile, hopefully this isn't too much additional strain (especially since I expect most people to switch to something faster after the first login). [EDIT] Also it's night time (well morning I guess) where I am so... spinning up some more instances and I'm going to sleep. [EDIT2] My email is plastered all over the site, but please feel free to email me any bug reports! [EDIT3] If you'd like to register an app, please check out https://mailing-list.vadosware.io/subscription/form https://mailing-list.vadosware.io/subscription/form ! Ignore all the other mailing list stuff and get on the "early adopters" list for LoginWithHN! Or just email me in my HN profile, whichever!
- will0 5y ago
  > you can then use either TOTP or Email (if you specify both, it will default to using TOTP) to login thereafter to make things quicker (it can take up to a minute until profiles update). I guess at this point it's more like login with loginwithhn?
  - hardwaresofton 5y ago
    Yup! LoginWithHN is the OAuth provider :) so the idea is if you have an app that you want people to use to login with HN, via LoginWithHN then you can use loginwithhn.com to make it happen
    - timoteostewart 5y ago
      Nice work! If there was a similar yet less efficient implementation of your idea, I guess we’d call it “nlogn with hn”!
  - shreddit 5y ago
    More like register with loginwithhn?
- dang 5y ago
  > I generally wait about 5 seconds between checks of a profile If you're scraping HN, please wait 30 seconds (https://news.ycombinator.com/robots.txt https://news.ycombinator.com/robots.txt) - our app server still runs on a single core, so we don't have a lot of performance to spare. (Hopefully that will change this year.) If you need to check more frequently, https://github.com/HackerNews/API https://github.com/HackerNews/API works fine and you can get JSON that way anyhow.
  - hardwaresofton 5y ago
    Hey Dang, so actually I DO wait 30 seconds -- what actually happens is that I check on the frontend every 5, but the backend checks every 30 (that's the default) interval. If you can believe it the code looks something like this: export const DEFAULT_HN_POLL_DELAY_MS = "30000"; export const DEFAULT_HN_POLL_MAX_CHECKS = 10; The code isn't F/OSS but I hope you can take my word on this, worst case what happens is that someone launches two intervals (I don't have any locking on that side) due to hitting two different machines. I'll be switching to the API by the end today and worst case by the weekend. [EDIT] Forgot to add this -- hope I didn't cause any disruption on your end. thanks for all the hard work as always.
    - dang 5y ago
      That sounds fine!
- somishere 5y ago
  Rather than polling you can probably just subscribe (via Firebase[1] and the HN API) to changes to the user's profile e.g[2] [1] https://firebase.google.com/docs/libraries#client-sdks https://firebase.google.com/docs/libraries#client-sdks [2] https://hacker-news.firebaseio.com/v0/user/hardwaresofton/about.json?print=pretty https://hacker-news.firebaseio.com/v0/user/hardwaresofton/ab...
  - hardwaresofton 5y ago
    Hey thanks for the suggestion, I'll check this out as well -- I definitely don't mind having more ways to check so I can spread load and what not.
Minor49er 5y ago
It didn't appear to be working after a couple of attempts. Opening the console shows a lot of HTTP 500 responses coming from /api/v1/hn/poll/status
- hardwaresofton 5y ago
  Shit good thing I didn't go to sleep, looking at it now [EDIT] - OK just pushed a new version -- it looks like it was a load issue, were you able to get in? [EDIT2] - Welp, looks like sleep isn't happening, looks like it's load triggered but there are some failures happening... I don't like this hug. [EDIT3] - We got 'em boys. Found the bug, rolling out now.
- jmkim 5y ago
  +1 Having same issue here
  - hardwaresofton 5y ago
    Hey would you mind trying again?
    - Minor49er 5y ago
      The API is responding that the request completed successfully, but it doesn't appear to authenticate. I even tried replacing my entire About section so that it was only the code and it didn't appear to recognize it
      - hardwaresofton 5y ago
        Hey I'm sorry for the really shit experience, do you mind if I reach out once I'm sure I've fixed it? It works for me but I still see occasional errors so I'm wondering just who it is :).
        Minor49er 5y ago
        I don't mind at all
kotrunga 5y ago
"I'm a yak shaver by trade" Nice. Do you have any sites that support the flow yet?
- spockz 5y ago
  I’m not sure why this couldn’t function as oauth provider for HN. Why does it support a new flow?
  - hardwaresofton 5y ago
    Yup that's the hope/intention -- If you have an app I can add you as an OAuth2 App (the registration page isn't up yet, but it will be soon)!
- hardwaresofton 5y ago
  None yet! If you would like to be the first please reach out or use this subscription form: https://mailing-list.vadosware.io/subscription/form https://mailing-list.vadosware.io/subscription/form (Ignore the mailing list bit). If you're able to log in there's a more direct form at the end of the flow!
- azalemeth 5y ago
  Is the author a literal yak shaver, á la sheep-shearer, but for yaks? (Or is it perhaps another way of saying "I can't legally tell you what I do for a living"?)
  - michaelt 5y ago
    It's a reference to https://en.wiktionary.org/wiki/yak_shaving https://en.wiktionary.org/wiki/yak_shaving The author is saying "Yes, I know I've built something that's not very useful here"
    - azalemeth 5y ago
      Thank you! I'd never heard that particular phrase before.
udbhavs 5y ago
Great idea. If you need to add a code to your bio, another idea is putting a public key in your HN bio and signing a nonce message using some browser extension like Metamask.
- Anunayj 5y ago
  Or just storing the key in browser with Web Crypto API (or localStorage cuz safari ffs). Ofc this means the key is only scoped to their domain.
- dividuum 5y ago
  Wouldn't it make more sense to store a blob containing the username, signed by loginwithhn in the profile. Something like HMAC(secret_kept_by_loginwithhn, username). Upon authorization, check if the blob is properly signed and matches the requested username. That way you'd only have to place it once and copying it between profiles isn't possible. I'm probably overlooking something.
  - rgovostes 5y ago
    Suppose you have logged into HN this way and so the token is in your profile. What would prevent me from logging in as dividuum?
    - dividuum 5y ago
      Nothing. You are correct of course and my suggestion is fatally flawed. Can’t edit my comment unfortunately. Guess that’s a reminder not to do half-assed protocol engineering while watching Netflix :-}
  - jtsiskin 5y ago
    This trusts loginwithhn. The metamask way can be used by any site and only need to trust hacker news.
maliker 5y ago
Awesome documentation!
dougk16 5y ago
I'm doing something very similar with my service: https://aytwit.com/thoughter https://aytwit.com/thoughter To the author, there is a simple trick you can pull in order to make the confirmation instantaneous and avoid caching. Have you figured it out? Let me know! I also use a residential proxy service for all my profile requests, regardless of the identity provider. For some sites like Twitter, Facebook, etc. this is required, and for something like Hacker News it's simply future-proofing in case they decide to block scrapers at some point in the future. Good work!
- diogenesjunior 5y ago
  >for something like Hacker News it's simply future-proofing in case they decide to block scrapers at some point in the future Why are you scraping? We have an API, it's linked at the bottom of every page[0]. 0: https://github.com/HackerNews/API https://github.com/HackerNews/API
  - dougk16 5y ago
    Good question, and thank you for the question. Both at the time of my initial development several years ago, and including now when I just tested it, scraping has faster response times (cache invalidations) to profile updates than the API. This saves the user of my site being frustrated that they put the code in their profile, but they keep smashing the "Check again" button to no avail. To be fair the API's cache invalidation does seem to have improved since last time I tested it. It only takes up to 5-10 seconds now, but still this is an eternity to an impatient user. Also since you imply you work for HN, I'll give you my little secret: If you randomly capitalize the letters in the HN username it invalidates the cache. Otherwise scraping the profile would indeed take as long as the API approach. I'm taking a risk with you fixing it now. :) I hope that helps clarify and I look forward to your thoughts.
    - diogenesjunior 5y ago
      I don't work for HN. I meant "we" as in "we the people of HN"
laputan_machine 5y ago
Great idea, I like the concept of using a code in your bio as the auth mechanism. As another poster replied, the api seems to be 500'ing
- hardwaresofton 5y ago
  Hey would you mind giving it another shot?
  - laputan_machine 5y ago
    Tried again, got a lot of 201s with: ``` {"status":"success","data":{"confirmed":false}} ``` Then a failure with a 502, I'll check it on a different network tomorrow to see if it's on my end
    - hardwaresofton 5y ago
      OK one more time! It's working for me right now -- I see the odd out of time error in the logs but the errors are mostly gone now: [Nest] 41 - 01/14/2022, 2:46:01 AM DEBUG [V1HNController] received polling status request for display token [E7tvuXJkkt] [Nest] 41 - 01/14/2022, 2:46:06 AM ERROR [LoginService] Error occurred while checking for HN profile page update: Error: Exceeded max checks [10] (delayMs: 30000) [Nest] 41 - 01/14/2022, 2:46:11 AM DEBUG [V1HNController] received polling status request for display token [E7tvuXJkkt] [Nest] 41 - 01/14/2022, 2:46:36 AM DEBUG [V1HNController] received polling status request for display token [E7tvuXJkkt] [Nest] 41 - 01/14/2022, 2:46:42 AM DEBUG [V1HNController] received polling status request for display token [E7tvuXJkkt] [Nest] 41 - 01/14/2022, 2:46:51 AM DEBUG [V1HNController] received polling status request for display token [unNyaItKHU] [Nest] 41 - 01/14/2022, 2:47:20 AM DEBUG [V1HNController] received polling status request for display token [e4DMemS2HG] [Nest] 41 - 01/14/2022, 2:47:30 AM DEBUG [V1HNController] received polling status request for display token [62553gB7GW] [Nest] 41 - 01/14/2022, 2:47:48 AM DEBUG [V1HNController] received polling status request for display token [unNyaItKHU] [Nest] 41 - 01/14/2022, 2:47:57 AM DEBUG [V1HNController] received polling status request for display token [dcKr3LelxA] [Nest] 41 - 01/14/2022, 2:48:22 AM DEBUG [V1HNController] received polling status request for display token [dcKr3LelxA] [Nest] 41 - 01/14/2022, 2:48:37 AM DEBUG [V1HNController] received polling status request for display token [dcKr3LelxA] [Nest] 41 - 01/14/2022, 2:48:52 AM DEBUG [V1HNController] received polling status request for display token [dcKr3LelxA] [Nest] 41 - 01/14/2022, 2:49:15 AM DEBUG [V1HNController] received polling status request for display token [e4DMemS2HG] [Nest] 41 - 01/14/2022, 2:49:22 AM DEBUG [V1ConsentController] retrieving data for consent challenge request [<redacted>] [Nest] 41 - 01/14/2022, 2:49:22 AM DEBUG [V1ConsentController] successful consent denial for user [hardwaresofton] [Nest] 41 - 01/14/2022, 2:50:30 AM DEBUG [V1HNController] received polling status request for display token [62553gB7GW] [Nest] 41 - 01/14/2022, 2:50:50 AM DEBUG [V1HNController] received polling status request for display token [ZAvILvhGhg] [Nest] 41 - 01/14/2022, 2:50:58 AM DEBUG [V1HNController] received polling status request for display token [unNyaItKHU] [Nest] 41 - 01/14/2022, 2:51:49 AM DEBUG [V1HNController] received polling status request for display token [qy4LrME0ny] [Nest] 41 - 01/14/2022, 2:52:24 AM DEBUG [V1LoginController] received start login request [zzc] [Nest] 41 - 01/14/2022, 2:52:24 AM DEBUG [V1LoginController] saved login request challenge with ID [<redacted>] [Nest] 41 - 01/14/2022, 2:52:26 AM DEBUG [V1HNController] received polling status request for display token [lBEUPtqdVF] [Nest] 41 - 01/14/2022, 2:52:30 AM DEBUG [V1HNController] received polling status request for display token [62553gB7GW Really appreciate you trying again -- I just did it myself and it was a long ~1min but it did work (in fact you can see me deny the consent actually in the logs :). And for the keen in here, yeah I'm running NestJS[0] -- this thing is over-engineered and some bugs still snuck through. [0]: https://docs.nestjs.com https://docs.nestjs.com
simonw 5y ago
This is a smart implementation. I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives you a token to embed in your public profile - so it's still scraping your profile page, but that feels like a very low-impact way of building this. Suggestion: on the "Put the token below in your HackerNews Profile" page, rather than polling to see if the token has been added (which is a bit rude) add a button for "I have added this token to my profile" and only check once the user clicks that button.
- tlarkworthy 5y ago
  the exact user flow for a third party Auth system in Observablehq https://observablehq.com/@endpointservices/login-with-comment https://observablehq.com/@endpointservices/login-with-commen... all code is ISC licensed and both the server and client is embedded in a web notebook
- johnkpaul 5y ago
  I totally agree with you and I was also worried about uncouth behavior. That said, and not to undercut the smartness here, I have memories of this being the main mechanism to authenticate third party services to the SomethingAwful forums. I have vague memories of thinking through how scraping could be used for much easier global authentication and then quickly how that was probably a dumb idea.
  - nvr219 5y ago
    Yep, I still do this with gbs.fm!
    - dmix 5y ago
      What is gbs.fm if you dont mind me asking?
      - nvr219 5y ago
        A community radio station where you have to be a somethingawful member to access.
metabagel 5y ago
Blocked by both Firefox and my company due to certificate issue.
- metabagel 5y ago
  Actually, looks like you are on a malware blacklist.
  - hardwaresofton 5y ago
    Could you tell me more about the blacklist? is it IP based? URL based? The servers are in Germany under Hetzner so maybe it's an IP ban that went in
todd3834 5y ago
Very cool, I was experimenting with a similar implementation of this a few years back. We were using a browser extension to handle the posting to the profile for you. However, we noticed that that profile was cached on the server so you would end up having to wait a long time to get a new version. I believe we tried appending a random query param to cache bust but the server didn't seem to care about that. Have you ran into this? If so, how did you get around it? [Edit] Here is a link to the now dead project :( http://web.archive.org/web/20161225152153/http://www.clap.chat/ http://web.archive.org/web/20161225152153/http://www.clap.ch... We briefly mention how it worked but didn't go into full detail
- hardwaresofton 5y ago
  Right now I'm actually just waiting a long time and checking somewhat slowly -- there's a note that it might take up to 1 min. I'm more concerned with not causing trouble for the staff, and usually it's about <1min so not the end of the world I think
- dougk16 5y ago
  I'm doing something similar with my service https://aytwit.com/thoughter https://aytwit.com/thoughter There is a trick to busting the cache but I almost don't want to say it in case they fix it lol. Feel free to contact me directly.
  - hardwaresofton 5y ago
    Hey thanks for this note :)
zemnmez 5y ago
it seems like if this is OAuth2, the protocol is not giving an audience specifier? That would mean that any token is as good as any other, and say, authenticating to evilsite.com, the site could use the token its granted to itself log onto another ‘login with HN’ website as the victim. Thats the usual issue with OAuth as login
- rank0 5y ago
  Thanks for pointing this out. Reading your comment just connected some dots in my head about the OAuth flow.
- hardwaresofton 5y ago
  Ah yes, this is something I'm going to tighten up once we have OAuth2 clients signed up -- right now the only client is the actual loginwithhn site itself!
colinclerk 5y ago
Wow, awesome! We've had a few startups ask for an HN integration at https://clerk.dev https://clerk.dev and we'll build this in ASAP. It would be great if this could somehow verify whether an HN account has been part of YC cohort. A few requests we've received were with the hope of offering early access to YC founders-only before a public release. Also, I love the OTP solution instead of asking for our HN passwords.
- dasickis 5y ago
  We have a solution here, email me: praful.mathur@gmail.com and we've worked out all the challenges with integrating with HN.
- hardwaresofton 5y ago
  Hey thanks -- I will definitely be sending you an email soon!
  - dasickis 5y ago
    For this you can use our membership token (which uses HN profile): https://opensea.io/collection/alumni-gems https://opensea.io/collection/alumni-gems Also we verify very similarly to you: https://badge.orangedao.xyz/ https://badge.orangedao.xyz/
motohagiography 5y ago
Using forums as pseudonymous identity providers is a very powerful idea. It's essentially community federation. There is of course risk that your IDP chucks your account and you lose access to the other ones, but that's solvable with a recovery scheme. Lightweight, low assurance credentials probably have the biggest growth future, as if universal high assurance credentials were really that commercially desirable, we'd already have them. These are a kind of affinity credential, which has a lot of optionality.
- dougk16 5y ago
  It's a powerful idea but say I'm a website that wants to add "Sign In With HN". Me personally I've lost faith with "Sign In With Facebook/Google/etc.", nevermind some random site offering sign ins with random forum identities. As a website owner, I would have to trust that the "Sign In With HN" service would still be there in a month or two, nevermind a year or two. If I wanted to create such an SSO service, what kind of reasonable social/technical guarantees could I make to website owners so they'd be confident I'd be around for the long haul? A better technical solution would be to offer an SDK that does the same thing that websites could integrate themselves, but then you have the explosion of languages and frameworks to support.
  - motohagiography 5y ago
    This is the good part. I'd rather avoid the SDK case, as I've run down that road before and it's fraught. If you affinity federate to HN, (or even a subreddit), and you create a recovery process that enables the user to migrate their local identity on our app to a new IDP, realistically, you could just federate to anything someone can store a key on, if you wanted to. The security of the users account is up to the user. If I want to bind my user account on your SaaS app to anything persistent online that I have control of, that should be sufficient for most low assurance purposes. The lightweight security of it is that if I enroll/register for your app as motohagio@location.public_key, my password for your site becomes just a random string encrypted with my private key, as that proves my possession of the private complement used for registration when you decrypt the string using the contents of the public key location I provided during enrollment. A lot of protocols already essentially look something like this, they're just not described in a casual comment. The lightweight security of the system isn't based on the secrecy of passwords, but rather, a combination of the secrecy of the users private key and the integrity of the registration pointer to that public key. It still works with browser passwords, as instead of a password string, you submit {randomstring, (randomstring)^privkey_privkey} and the RP app just looks up its registered public key pointer, and makes sure the random string in the ciphertext matches. Problem it solves is net-net it shifts risk off your service, onto the user, and removes a single point of user compromise for all users at once. You can federate your service to any document on the internet that persists a public key, and account compromises don't scale the same way. The most obvious vulnerability is the integrity and availability of the location and directory services of that public key location. But cacheing and recovery schemes could make it viable. (some people will be apopleptic at the mere mention of it, but it's a use case for the chains made of block) I've done the high assurance use case design on a variety of other products, but maybe the low assurance case is the one that's actually useful. Irony is it may still require a password manager / authenticator client for most users, but in the majority of logins, you can still save this new token in your browser as a password.
hirundo 5y ago
I can speak more freely on a forum if my logins are independent. If they are federated I have more to lose by saying the wrong thing. There are scarcely any values I can express without offending someone. For this purpose at least, it looks like a better strategy to have multiple isolated credentials. With a password manager the inconvenience almost disappears.
- xtracto 5y ago
  Right, in addition to that, I am currently in the process of de-Googlifying and de-Facebookfying all my logins. I prefer the tired and tried method of having a separate login and password for each account, and save them on KeePassXC. There have been plenty of horror stories of people that lose access to their Google or Facebook account, and suddenly cannot access their connected accounts.
outloudvi 5y ago
Interesting. However, it requires your trust to the service. So probably the identity user shall build and host such service by themselves. Or a more trusty solution is to make the identity verifiable. Oh, did I say Keybase(the former one not acquired by Zoom)?
ramon 5y ago
Would be interesting to come up with a nice use case now with this.
- hardwaresofton 5y ago
  Well it's technically a usecase for itself... so there's that?
tomhallett 5y ago
Question - are you affiliated with HN/YC at all? If not, I would be concerned about the colors/branding on the homepage being the same as HN/YC. I see the word “unofficially”, but it feels like there still might be some confusion of how it relates to YC’s software.
- hardwaresofton 5y ago
  Nope not affiliated at all! I thought "unofficially" was enough but I'll make it a bit more clear [EDIT] I added another disclaimer
  - tomhallett 5y ago
    Very cool! That's what I had in mind. Agreed that you added "unoffically", but you also created a new method todo login (vs cookies/oauth2/etc), so I wasn't sure how to map the "unoffically" word with your novel approach. Your disclamer makes it very clear. :)
    - hardwaresofton 5y ago
      Thanks for bringing it up, glad to correct it!
deleted 5y ago
[deleted]
gruez 5y ago
>How does it work? >[...] >LoginWithHN generates a unique one-time-use code that the user must then put into their profile within 5 minutes I like the implementation, but shouldn't the code be something more explicit? Otherwise it might be easy to social engineer someone into putting in the code. Currently it's >Put the token below in your HackerNews Profile ↗ >[random letters] I think Keybase does something more explicit, with something like "my keybase verification code is xyz"
- hardwaresofton 5y ago
  You're right -- I will make this more explicit to hopefully prevent some phishing attempts
- colinclerk 5y ago
  I agree this is a concern, though more with phishing than social engineering. An attacker site pretends to have their own "Login with HN" implementation, but asks users to put in a code generated from LoginWithHN.com itself. If the user adds the code, then the attacker can impersonate the victim on any service that supports LoginWithHN.com (because of the special second-time login handling) If the string was more explicit that it's for LoginWithHN.com, the victim is more likely to recognize that something phishy is going on.
  - hardwaresofton 5y ago
    Thanks for the suggestion, this is a great idea. The phishing angle is not one I had considered
Visayer 5y ago
Victor, congratulations on the launch! I am one of the maintainers at https://github.com/ory/hydra https://github.com/ory/hydra and it makes me super happy to see that Ory Hydra is being used for such innovative projects :) If you’re interested to join Ory, we’d be excited to have you! Drop Aeneas a line and he’ll take it from there: aeneas@ory.sh Hopefully we’ll talk soon :)
- hardwaresofton 5y ago
  Hey I appreciate it! It's a tiny little hack but I'm glad people seem to like it! ORY Hydra was fantastic every step of the way, I originally started with a completely different tool/approach actually then switched to Hydra and rewrote things and it was way smoother. Thanks for the awesome tooling you make.
  - Visayer 5y ago
    Appreciate the kind words! :)
- bobberkarl 5y ago
  Hey, i had to evaluate the ORY suite for multiple projects, and we always had to fallback to keycloak. Major reason was the completeness of the keycloak admin gui vis-à-vis of Ory. Is there a gui in your plans, or a public repo? I want to contribute.
AnotherGoodName 5y ago
This site isn't really intended for high security. It doesn't matter that much since Hackernews login is only for this site and text posts here are not that valuable. If it was expanded in usage it could be disastrous. The fact that the admins of this site do manual recovery for example is a terrible practice that no serious providers do. In fact the reason i'm 'AnotherGoodName' rather than my old AReallyGoodName is because i suffered account takeover on this site. The last three posts from AReallyGoodName promoting CoinRace are not me. The rest, including posts for my github projects (i still own my Github) are. https://news.ycombinator.com/item?id=16460663#16461236 https://news.ycombinator.com/item?id=16460663#16461236 I do not think for one second that Hackernews is ready to handle sign ins for things that need more security than this site itself.
paxys 5y ago
This is neat. How do you protect against a third party scanning HN profiles for codes and stealing them?
- hardwaresofton 5y ago
  Ah, so because the login challenge is unique, the person would have to have access to the browser that received the original login challenge -- there's a second second secret when you initiate login (that's part of the bit managed by ORY Hydra)
hnarn 5y ago
This is kind of reminiscent of how keybase verifies your ownership of social media accounts, domain names etc.
deleted 5y ago
[deleted]
version_five 5y ago
Congrats on putting this together, it looks really cool. One suggested feature that crossed my mind is to allow a minimum karma or account tenure requirement, in order to screen for throwaway accounts in cases where this mattered.
- hardwaresofton 5y ago
  That's a fantastic idea, thank you, I'll implement that.
clay-dreidels 5y ago
This is a smart, safe implementation. On a side note: I wish HN offered 2FA.
- hardwaresofton 5y ago
  SAME. If they were into offering 2FA I could happily retire this little hack :) I was a bit worried that what I was doing was against the spirit of HN (HN is very much not a social site in that way, and I think they strive not to be), but if they ever choose to add native 2FA I'll be over the moon.
jrs235 5y ago
This is awesome! I had this same idea just last week! Way to execute!
adamrezich 5y ago
nice! I did a very similar thing many years ago for the video game website giantbomb.com. they have a wiki and you get points for making contributions, but there's nothing to do with the points, they don't do anything. so I made my own website where you could predict review scores they would give upcoming games, and "gamble" (a copy of) your giantbomb.com account's wiki points, which were scraped once you logged in with pretty much the exact same system (putting a generated hash into your account profile). I've always thought that this is a neat idea and similar methods could be used to make all kinds of cross-account connection stuff work on various websites. if you're making any kind of social site like this, allow users to have an editable public bio!
quickthrower2 5y ago
Nice. Its the equivalent of domain name verification using TXT records, but for HN profiles!
lostmsu 5y ago
I wonder if this concept could (and perhaps should) be extended to be OAuth provider, that lets you in based on ability to control content under arbitrary URL. Maybe even standardized somehow by exposing meta tags in the HTML header.
- hardwaresofton 5y ago
  So the idea is that the site is an OAuth2/OpenID connect provider, but one that actually authorizes/authenticates for a site I obviously don't own (HN). I'm not sure I fully understood your idea but setting this was exceedingly easy with the help of ORY Hydra[0], please check em out. [0]: https://www.ory.sh/hydra/docs/concepts/login https://www.ory.sh/hydra/docs/concepts/login
  - lostmsu 5y ago
    The idea is that your OAuth site could let me login with https://example.com/it_is_me_i_swear https://example.com/it_is_me_i_swear as long as I am able to put the token you generated somewhere in that page. Not necessarily with https://news.ycombinator.com/user?id=lostmsu https://news.ycombinator.com/user?id=lostmsu
    - hardwaresofton 5y ago
      Ahhh yep, I’ve actually got some plans for some other sites I could support! If you’re referring more to the possibility of you owning the site itself that’s possible too
nailer 5y ago
Hah I had the idea to do this but not using OpenID (show a token on an account to prove you own it) - kudos to using standards! The use case was stealing the userbase from a stagnant competitor allowing everyone to keep their existing usernames on my platform.
zeepzeep 5y ago
Hey this is neat. Great work, I really like such weird ideas and it looks so professional!
- hardwaresofton 5y ago
  Thanks for the note :) yeah it was a really quick hack -- it only looks professional thanks to mvp.css[0]! [0]: https://andybrewer.github.io/mvp/ https://andybrewer.github.io/mvp/
voussoir 5y ago
Hi, I just wanted to say I have fond memories of using garrysmod.org to download add-ons for gmod back in 2008-2010 or so. They used the same authentication technique by giving the user a token to put on their Steam profile. I'm still wearing mine! As long as the entity in question (HN, Steam) isn't at risk of going bust, I think this is very practical. Best of luck.
- hardwaresofton 5y ago
  Thanks, appreciate the note! I actually never got into garrysmod (I basically started with CS: Source then went to CS:GO) so I never saw that, but I'm glad it makes sense and there's some historical precedent I'm not afoul of.
schwede 5y ago
I think it’s in poor taste to theme your site to look like HN. Feels a little close to phishing.
- hardwaresofton 5y ago
  I did think about it, but I don't think it's too bad -- the site is plastered with "unofficially" and the disclaimer to prevent that. I love how minimal HN is and I don't think I've ever seen orange work this well on a site in my life to be honest, so I wanted to pay a little homage and also have people feel at home. I'll definitely consider changing the theme, and I've already added a disclaimer.

Implementation idea: this method reminds me that we can post our public keys in bio, which means logging in could just mean signing a message that says "sign me in to %service%" and you wouldn't need to update your bio for each service you log in to

hardwaresofton 5y ago

Hey HN, I wanted to be able to make apps that do social login with HN so I hacked it together. It works like you would expect -- generating a code you can put in your profile. For convenience, you can then use either TOTP or Email (if you specify both, it will default to using TOTP) to login thereafter to make things quicker (it can take up to a minute until profiles update). I generally wait about 5 seconds between checks of a profile, hopefully this isn't too much additional strain (especially since I expect most people to switch to something faster after the first login). [EDIT] Also it's night time (well morning I guess) where I am so... spinning up some more instances and I'm going to sleep. [EDIT2] My email is plastered all over the site, but please feel free to email me any bug reports! [EDIT3] If you'd like to register an app, please check out https://mailing-list.vadosware.io/subscription/form https://mailing-list.vadosware.io/subscription/form ! Ignore all the other mailing list stuff and get on the "early adopters" list for LoginWithHN! Or just email me in my HN profile, whichever!

will0 5y ago
> you can then use either TOTP or Email (if you specify both, it will default to using TOTP) to login thereafter to make things quicker (it can take up to a minute until profiles update). I guess at this point it's more like login with loginwithhn?
- hardwaresofton 5y ago
  Yup! LoginWithHN is the OAuth provider :) so the idea is if you have an app that you want people to use to login with HN, via LoginWithHN then you can use loginwithhn.com to make it happen
  - timoteostewart 5y ago
    Nice work! If there was a similar yet less efficient implementation of your idea, I guess we’d call it “nlogn with hn”!
- shreddit 5y ago
  More like register with loginwithhn?
dang 5y ago
> I generally wait about 5 seconds between checks of a profile If you're scraping HN, please wait 30 seconds (https://news.ycombinator.com/robots.txt https://news.ycombinator.com/robots.txt) - our app server still runs on a single core, so we don't have a lot of performance to spare. (Hopefully that will change this year.) If you need to check more frequently, https://github.com/HackerNews/API https://github.com/HackerNews/API works fine and you can get JSON that way anyhow.
- hardwaresofton 5y ago
  Hey Dang, so actually I DO wait 30 seconds -- what actually happens is that I check on the frontend every 5, but the backend checks every 30 (that's the default) interval. If you can believe it the code looks something like this: export const DEFAULT_HN_POLL_DELAY_MS = "30000"; export const DEFAULT_HN_POLL_MAX_CHECKS = 10; The code isn't F/OSS but I hope you can take my word on this, worst case what happens is that someone launches two intervals (I don't have any locking on that side) due to hitting two different machines. I'll be switching to the API by the end today and worst case by the weekend. [EDIT] Forgot to add this -- hope I didn't cause any disruption on your end. thanks for all the hard work as always.
  - dang 5y ago
    That sounds fine!
somishere 5y ago
Rather than polling you can probably just subscribe (via Firebase[1] and the HN API) to changes to the user's profile e.g[2] [1] https://firebase.google.com/docs/libraries#client-sdks https://firebase.google.com/docs/libraries#client-sdks [2] https://hacker-news.firebaseio.com/v0/user/hardwaresofton/about.json?print=pretty https://hacker-news.firebaseio.com/v0/user/hardwaresofton/ab...
- hardwaresofton 5y ago
  Hey thanks for the suggestion, I'll check this out as well -- I definitely don't mind having more ways to check so I can spread load and what not.

Minor49er 5y ago

It didn't appear to be working after a couple of attempts. Opening the console shows a lot of HTTP 500 responses coming from /api/v1/hn/poll/status

hardwaresofton 5y ago
Shit good thing I didn't go to sleep, looking at it now [EDIT] - OK just pushed a new version -- it looks like it was a load issue, were you able to get in? [EDIT2] - Welp, looks like sleep isn't happening, looks like it's load triggered but there are some failures happening... I don't like this hug. [EDIT3] - We got 'em boys. Found the bug, rolling out now.
jmkim 5y ago
+1 Having same issue here
- hardwaresofton 5y ago
  Hey would you mind trying again?
  - Minor49er 5y ago
    The API is responding that the request completed successfully, but it doesn't appear to authenticate. I even tried replacing my entire About section so that it was only the code and it didn't appear to recognize it
    - hardwaresofton 5y ago
      Hey I'm sorry for the really shit experience, do you mind if I reach out once I'm sure I've fixed it? It works for me but I still see occasional errors so I'm wondering just who it is :).
      - Minor49er 5y ago
        I don't mind at all

kotrunga 5y ago

"I'm a yak shaver by trade" Nice. Do you have any sites that support the flow yet?

spockz 5y ago
I’m not sure why this couldn’t function as oauth provider for HN. Why does it support a new flow?
- hardwaresofton 5y ago
  Yup that's the hope/intention -- If you have an app I can add you as an OAuth2 App (the registration page isn't up yet, but it will be soon)!
hardwaresofton 5y ago
None yet! If you would like to be the first please reach out or use this subscription form: https://mailing-list.vadosware.io/subscription/form https://mailing-list.vadosware.io/subscription/form (Ignore the mailing list bit). If you're able to log in there's a more direct form at the end of the flow!
azalemeth 5y ago
Is the author a literal yak shaver, á la sheep-shearer, but for yaks? (Or is it perhaps another way of saying "I can't legally tell you what I do for a living"?)
- michaelt 5y ago
  It's a reference to https://en.wiktionary.org/wiki/yak_shaving https://en.wiktionary.org/wiki/yak_shaving The author is saying "Yes, I know I've built something that's not very useful here"
  - azalemeth 5y ago
    Thank you! I'd never heard that particular phrase before.

udbhavs 5y ago

Great idea. If you need to add a code to your bio, another idea is putting a public key in your HN bio and signing a nonce message using some browser extension like Metamask.

Anunayj 5y ago
Or just storing the key in browser with Web Crypto API (or localStorage cuz safari ffs). Ofc this means the key is only scoped to their domain.
dividuum 5y ago
Wouldn't it make more sense to store a blob containing the username, signed by loginwithhn in the profile. Something like HMAC(secret_kept_by_loginwithhn, username). Upon authorization, check if the blob is properly signed and matches the requested username. That way you'd only have to place it once and copying it between profiles isn't possible. I'm probably overlooking something.
- rgovostes 5y ago
  Suppose you have logged into HN this way and so the token is in your profile. What would prevent me from logging in as dividuum?
  - dividuum 5y ago
    Nothing. You are correct of course and my suggestion is fatally flawed. Can’t edit my comment unfortunately. Guess that’s a reminder not to do half-assed protocol engineering while watching Netflix :-}
- jtsiskin 5y ago
  This trusts loginwithhn. The metamask way can be used by any site and only need to trust hacker news.

maliker 5y ago

Awesome documentation!

dougk16 5y ago

I'm doing something very similar with my service: https://aytwit.com/thoughter https://aytwit.com/thoughter To the author, there is a simple trick you can pull in order to make the confirmation instantaneous and avoid caching. Have you figured it out? Let me know! I also use a residential proxy service for all my profile requests, regardless of the identity provider. For some sites like Twitter, Facebook, etc. this is required, and for something like Hacker News it's simply future-proofing in case they decide to block scrapers at some point in the future. Good work!

diogenesjunior 5y ago
>for something like Hacker News it's simply future-proofing in case they decide to block scrapers at some point in the future Why are you scraping? We have an API, it's linked at the bottom of every page[0]. 0: https://github.com/HackerNews/API https://github.com/HackerNews/API
- dougk16 5y ago
  Good question, and thank you for the question. Both at the time of my initial development several years ago, and including now when I just tested it, scraping has faster response times (cache invalidations) to profile updates than the API. This saves the user of my site being frustrated that they put the code in their profile, but they keep smashing the "Check again" button to no avail. To be fair the API's cache invalidation does seem to have improved since last time I tested it. It only takes up to 5-10 seconds now, but still this is an eternity to an impatient user. Also since you imply you work for HN, I'll give you my little secret: If you randomly capitalize the letters in the HN username it invalidates the cache. Otherwise scraping the profile would indeed take as long as the API approach. I'm taking a risk with you fixing it now. :) I hope that helps clarify and I look forward to your thoughts.
  - diogenesjunior 5y ago
    I don't work for HN. I meant "we" as in "we the people of HN"

laputan_machine 5y ago

Great idea, I like the concept of using a code in your bio as the auth mechanism. As another poster replied, the api seems to be 500'ing

hardwaresofton 5y ago
Hey would you mind giving it another shot?
- laputan_machine 5y ago
  Tried again, got a lot of 201s with: ``` {"status":"success","data":{"confirmed":false}} ``` Then a failure with a 502, I'll check it on a different network tomorrow to see if it's on my end
  - hardwaresofton 5y ago
    OK one more time! It's working for me right now -- I see the odd out of time error in the logs but the errors are mostly gone now: [Nest] 41 - 01/14/2022, 2:46:01 AM DEBUG [V1HNController] received polling status request for display token [E7tvuXJkkt] [Nest] 41 - 01/14/2022, 2:46:06 AM ERROR [LoginService] Error occurred while checking for HN profile page update: Error: Exceeded max checks [10] (delayMs: 30000) [Nest] 41 - 01/14/2022, 2:46:11 AM DEBUG [V1HNController] received polling status request for display token [E7tvuXJkkt] [Nest] 41 - 01/14/2022, 2:46:36 AM DEBUG [V1HNController] received polling status request for display token [E7tvuXJkkt] [Nest] 41 - 01/14/2022, 2:46:42 AM DEBUG [V1HNController] received polling status request for display token [E7tvuXJkkt] [Nest] 41 - 01/14/2022, 2:46:51 AM DEBUG [V1HNController] received polling status request for display token [unNyaItKHU] [Nest] 41 - 01/14/2022, 2:47:20 AM DEBUG [V1HNController] received polling status request for display token [e4DMemS2HG] [Nest] 41 - 01/14/2022, 2:47:30 AM DEBUG [V1HNController] received polling status request for display token [62553gB7GW] [Nest] 41 - 01/14/2022, 2:47:48 AM DEBUG [V1HNController] received polling status request for display token [unNyaItKHU] [Nest] 41 - 01/14/2022, 2:47:57 AM DEBUG [V1HNController] received polling status request for display token [dcKr3LelxA] [Nest] 41 - 01/14/2022, 2:48:22 AM DEBUG [V1HNController] received polling status request for display token [dcKr3LelxA] [Nest] 41 - 01/14/2022, 2:48:37 AM DEBUG [V1HNController] received polling status request for display token [dcKr3LelxA] [Nest] 41 - 01/14/2022, 2:48:52 AM DEBUG [V1HNController] received polling status request for display token [dcKr3LelxA] [Nest] 41 - 01/14/2022, 2:49:15 AM DEBUG [V1HNController] received polling status request for display token [e4DMemS2HG] [Nest] 41 - 01/14/2022, 2:49:22 AM DEBUG [V1ConsentController] retrieving data for consent challenge request [<redacted>] [Nest] 41 - 01/14/2022, 2:49:22 AM DEBUG [V1ConsentController] successful consent denial for user [hardwaresofton] [Nest] 41 - 01/14/2022, 2:50:30 AM DEBUG [V1HNController] received polling status request for display token [62553gB7GW] [Nest] 41 - 01/14/2022, 2:50:50 AM DEBUG [V1HNController] received polling status request for display token [ZAvILvhGhg] [Nest] 41 - 01/14/2022, 2:50:58 AM DEBUG [V1HNController] received polling status request for display token [unNyaItKHU] [Nest] 41 - 01/14/2022, 2:51:49 AM DEBUG [V1HNController] received polling status request for display token [qy4LrME0ny] [Nest] 41 - 01/14/2022, 2:52:24 AM DEBUG [V1LoginController] received start login request [zzc] [Nest] 41 - 01/14/2022, 2:52:24 AM DEBUG [V1LoginController] saved login request challenge with ID [<redacted>] [Nest] 41 - 01/14/2022, 2:52:26 AM DEBUG [V1HNController] received polling status request for display token [lBEUPtqdVF] [Nest] 41 - 01/14/2022, 2:52:30 AM DEBUG [V1HNController] received polling status request for display token [62553gB7GW Really appreciate you trying again -- I just did it myself and it was a long ~1min but it did work (in fact you can see me deny the consent actually in the logs :). And for the keen in here, yeah I'm running NestJS[0] -- this thing is over-engineered and some bugs still snuck through. [0]: https://docs.nestjs.com https://docs.nestjs.com

simonw 5y ago

This is a smart implementation. I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives you a token to embed in your public profile - so it's still scraping your profile page, but that feels like a very low-impact way of building this. Suggestion: on the "Put the token below in your HackerNews Profile" page, rather than polling to see if the token has been added (which is a bit rude) add a button for "I have added this token to my profile" and only check once the user clicks that button.

tlarkworthy 5y ago
the exact user flow for a third party Auth system in Observablehq https://observablehq.com/@endpointservices/login-with-comment https://observablehq.com/@endpointservices/login-with-commen... all code is ISC licensed and both the server and client is embedded in a web notebook
johnkpaul 5y ago
I totally agree with you and I was also worried about uncouth behavior. That said, and not to undercut the smartness here, I have memories of this being the main mechanism to authenticate third party services to the SomethingAwful forums. I have vague memories of thinking through how scraping could be used for much easier global authentication and then quickly how that was probably a dumb idea.
- nvr219 5y ago
  Yep, I still do this with gbs.fm!
  - dmix 5y ago
    What is gbs.fm if you dont mind me asking?
    - nvr219 5y ago
      A community radio station where you have to be a somethingawful member to access.

metabagel 5y ago

Blocked by both Firefox and my company due to certificate issue.

metabagel 5y ago
Actually, looks like you are on a malware blacklist.
- hardwaresofton 5y ago
  Could you tell me more about the blacklist? is it IP based? URL based? The servers are in Germany under Hetzner so maybe it's an IP ban that went in

todd3834 5y ago

Very cool, I was experimenting with a similar implementation of this a few years back. We were using a browser extension to handle the posting to the profile for you. However, we noticed that that profile was cached on the server so you would end up having to wait a long time to get a new version. I believe we tried appending a random query param to cache bust but the server didn't seem to care about that. Have you ran into this? If so, how did you get around it? [Edit] Here is a link to the now dead project :( http://web.archive.org/web/20161225152153/http://www.clap.chat/ http://web.archive.org/web/20161225152153/http://www.clap.ch... We briefly mention how it worked but didn't go into full detail

hardwaresofton 5y ago
Right now I'm actually just waiting a long time and checking somewhat slowly -- there's a note that it might take up to 1 min. I'm more concerned with not causing trouble for the staff, and usually it's about <1min so not the end of the world I think
dougk16 5y ago
I'm doing something similar with my service https://aytwit.com/thoughter https://aytwit.com/thoughter There is a trick to busting the cache but I almost don't want to say it in case they fix it lol. Feel free to contact me directly.
- hardwaresofton 5y ago
  Hey thanks for this note :)

zemnmez 5y ago

it seems like if this is OAuth2, the protocol is not giving an audience specifier? That would mean that any token is as good as any other, and say, authenticating to evilsite.com, the site could use the token its granted to itself log onto another ‘login with HN’ website as the victim. Thats the usual issue with OAuth as login

rank0 5y ago
Thanks for pointing this out. Reading your comment just connected some dots in my head about the OAuth flow.
hardwaresofton 5y ago
Ah yes, this is something I'm going to tighten up once we have OAuth2 clients signed up -- right now the only client is the actual loginwithhn site itself!

colinclerk 5y ago

Wow, awesome! We've had a few startups ask for an HN integration at https://clerk.dev https://clerk.dev and we'll build this in ASAP. It would be great if this could somehow verify whether an HN account has been part of YC cohort. A few requests we've received were with the hope of offering early access to YC founders-only before a public release. Also, I love the OTP solution instead of asking for our HN passwords.

dasickis 5y ago
We have a solution here, email me: praful.mathur@gmail.com and we've worked out all the challenges with integrating with HN.
hardwaresofton 5y ago
Hey thanks -- I will definitely be sending you an email soon!
- dasickis 5y ago
  For this you can use our membership token (which uses HN profile): https://opensea.io/collection/alumni-gems https://opensea.io/collection/alumni-gems Also we verify very similarly to you: https://badge.orangedao.xyz/ https://badge.orangedao.xyz/

motohagiography 5y ago

Using forums as pseudonymous identity providers is a very powerful idea. It's essentially community federation. There is of course risk that your IDP chucks your account and you lose access to the other ones, but that's solvable with a recovery scheme. Lightweight, low assurance credentials probably have the biggest growth future, as if universal high assurance credentials were really that commercially desirable, we'd already have them. These are a kind of affinity credential, which has a lot of optionality.

dougk16 5y ago
It's a powerful idea but say I'm a website that wants to add "Sign In With HN". Me personally I've lost faith with "Sign In With Facebook/Google/etc.", nevermind some random site offering sign ins with random forum identities. As a website owner, I would have to trust that the "Sign In With HN" service would still be there in a month or two, nevermind a year or two. If I wanted to create such an SSO service, what kind of reasonable social/technical guarantees could I make to website owners so they'd be confident I'd be around for the long haul? A better technical solution would be to offer an SDK that does the same thing that websites could integrate themselves, but then you have the explosion of languages and frameworks to support.
- motohagiography 5y ago
  This is the good part. I'd rather avoid the SDK case, as I've run down that road before and it's fraught. If you affinity federate to HN, (or even a subreddit), and you create a recovery process that enables the user to migrate their local identity on our app to a new IDP, realistically, you could just federate to anything someone can store a key on, if you wanted to. The security of the users account is up to the user. If I want to bind my user account on your SaaS app to anything persistent online that I have control of, that should be sufficient for most low assurance purposes. The lightweight security of it is that if I enroll/register for your app as motohagio@location.public_key, my password for your site becomes just a random string encrypted with my private key, as that proves my possession of the private complement used for registration when you decrypt the string using the contents of the public key location I provided during enrollment. A lot of protocols already essentially look something like this, they're just not described in a casual comment. The lightweight security of the system isn't based on the secrecy of passwords, but rather, a combination of the secrecy of the users private key and the integrity of the registration pointer to that public key. It still works with browser passwords, as instead of a password string, you submit {randomstring, (randomstring)^privkey_privkey} and the RP app just looks up its registered public key pointer, and makes sure the random string in the ciphertext matches. Problem it solves is net-net it shifts risk off your service, onto the user, and removes a single point of user compromise for all users at once. You can federate your service to any document on the internet that persists a public key, and account compromises don't scale the same way. The most obvious vulnerability is the integrity and availability of the location and directory services of that public key location. But cacheing and recovery schemes could make it viable. (some people will be apopleptic at the mere mention of it, but it's a use case for the chains made of block) I've done the high assurance use case design on a variety of other products, but maybe the low assurance case is the one that's actually useful. Irony is it may still require a password manager / authenticator client for most users, but in the majority of logins, you can still save this new token in your browser as a password.

hirundo 5y ago

I can speak more freely on a forum if my logins are independent. If they are federated I have more to lose by saying the wrong thing. There are scarcely any values I can express without offending someone. For this purpose at least, it looks like a better strategy to have multiple isolated credentials. With a password manager the inconvenience almost disappears.

xtracto 5y ago
Right, in addition to that, I am currently in the process of de-Googlifying and de-Facebookfying all my logins. I prefer the tired and tried method of having a separate login and password for each account, and save them on KeePassXC. There have been plenty of horror stories of people that lose access to their Google or Facebook account, and suddenly cannot access their connected accounts.

outloudvi 5y ago

Interesting. However, it requires your trust to the service. So probably the identity user shall build and host such service by themselves. Or a more trusty solution is to make the identity verifiable. Oh, did I say Keybase(the former one not acquired by Zoom)?

ramon 5y ago

Would be interesting to come up with a nice use case now with this.

hardwaresofton 5y ago
Well it's technically a usecase for itself... so there's that?

tomhallett 5y ago

Question - are you affiliated with HN/YC at all? If not, I would be concerned about the colors/branding on the homepage being the same as HN/YC. I see the word “unofficially”, but it feels like there still might be some confusion of how it relates to YC’s software.

hardwaresofton 5y ago
Nope not affiliated at all! I thought "unofficially" was enough but I'll make it a bit more clear [EDIT] I added another disclaimer
- tomhallett 5y ago
  Very cool! That's what I had in mind. Agreed that you added "unoffically", but you also created a new method todo login (vs cookies/oauth2/etc), so I wasn't sure how to map the "unoffically" word with your novel approach. Your disclamer makes it very clear. :)
  - hardwaresofton 5y ago
    Thanks for bringing it up, glad to correct it!

deleted 5y ago

[deleted]

gruez 5y ago

>How does it work? >[...] >LoginWithHN generates a unique one-time-use code that the user must then put into their profile within 5 minutes I like the implementation, but shouldn't the code be something more explicit? Otherwise it might be easy to social engineer someone into putting in the code. Currently it's >Put the token below in your HackerNews Profile ↗ >[random letters] I think Keybase does something more explicit, with something like "my keybase verification code is xyz"

hardwaresofton 5y ago
You're right -- I will make this more explicit to hopefully prevent some phishing attempts
colinclerk 5y ago
I agree this is a concern, though more with phishing than social engineering. An attacker site pretends to have their own "Login with HN" implementation, but asks users to put in a code generated from LoginWithHN.com itself. If the user adds the code, then the attacker can impersonate the victim on any service that supports LoginWithHN.com (because of the special second-time login handling) If the string was more explicit that it's for LoginWithHN.com, the victim is more likely to recognize that something phishy is going on.
- hardwaresofton 5y ago
  Thanks for the suggestion, this is a great idea. The phishing angle is not one I had considered

Visayer 5y ago

Victor, congratulations on the launch! I am one of the maintainers at https://github.com/ory/hydra https://github.com/ory/hydra and it makes me super happy to see that Ory Hydra is being used for such innovative projects :) If you’re interested to join Ory, we’d be excited to have you! Drop Aeneas a line and he’ll take it from there: aeneas@ory.sh Hopefully we’ll talk soon :)

hardwaresofton 5y ago
Hey I appreciate it! It's a tiny little hack but I'm glad people seem to like it! ORY Hydra was fantastic every step of the way, I originally started with a completely different tool/approach actually then switched to Hydra and rewrote things and it was way smoother. Thanks for the awesome tooling you make.
- Visayer 5y ago
  Appreciate the kind words! :)
bobberkarl 5y ago
Hey, i had to evaluate the ORY suite for multiple projects, and we always had to fallback to keycloak. Major reason was the completeness of the keycloak admin gui vis-à-vis of Ory. Is there a gui in your plans, or a public repo? I want to contribute.

AnotherGoodName 5y ago

This site isn't really intended for high security. It doesn't matter that much since Hackernews login is only for this site and text posts here are not that valuable. If it was expanded in usage it could be disastrous. The fact that the admins of this site do manual recovery for example is a terrible practice that no serious providers do. In fact the reason i'm 'AnotherGoodName' rather than my old AReallyGoodName is because i suffered account takeover on this site. The last three posts from AReallyGoodName promoting CoinRace are not me. The rest, including posts for my github projects (i still own my Github) are. https://news.ycombinator.com/item?id=16460663#16461236 https://news.ycombinator.com/item?id=16460663#16461236 I do not think for one second that Hackernews is ready to handle sign ins for things that need more security than this site itself.

paxys 5y ago

This is neat. How do you protect against a third party scanning HN profiles for codes and stealing them?

hardwaresofton 5y ago
Ah, so because the login challenge is unique, the person would have to have access to the browser that received the original login challenge -- there's a second second secret when you initiate login (that's part of the bit managed by ORY Hydra)

hnarn 5y ago

This is kind of reminiscent of how keybase verifies your ownership of social media accounts, domain names etc.

deleted 5y ago

[deleted]

version_five 5y ago

Congrats on putting this together, it looks really cool. One suggested feature that crossed my mind is to allow a minimum karma or account tenure requirement, in order to screen for throwaway accounts in cases where this mattered.

hardwaresofton 5y ago
That's a fantastic idea, thank you, I'll implement that.

clay-dreidels 5y ago

This is a smart, safe implementation. On a side note: I wish HN offered 2FA.

hardwaresofton 5y ago
SAME. If they were into offering 2FA I could happily retire this little hack :) I was a bit worried that what I was doing was against the spirit of HN (HN is very much not a social site in that way, and I think they strive not to be), but if they ever choose to add native 2FA I'll be over the moon.

jrs235 5y ago

This is awesome! I had this same idea just last week! Way to execute!

adamrezich 5y ago

nice! I did a very similar thing many years ago for the video game website giantbomb.com. they have a wiki and you get points for making contributions, but there's nothing to do with the points, they don't do anything. so I made my own website where you could predict review scores they would give upcoming games, and "gamble" (a copy of) your giantbomb.com account's wiki points, which were scraped once you logged in with pretty much the exact same system (putting a generated hash into your account profile). I've always thought that this is a neat idea and similar methods could be used to make all kinds of cross-account connection stuff work on various websites. if you're making any kind of social site like this, allow users to have an editable public bio!

quickthrower2 5y ago

Nice. Its the equivalent of domain name verification using TXT records, but for HN profiles!

lostmsu 5y ago

I wonder if this concept could (and perhaps should) be extended to be OAuth provider, that lets you in based on ability to control content under arbitrary URL. Maybe even standardized somehow by exposing meta tags in the HTML header.

hardwaresofton 5y ago
So the idea is that the site is an OAuth2/OpenID connect provider, but one that actually authorizes/authenticates for a site I obviously don't own (HN). I'm not sure I fully understood your idea but setting this was exceedingly easy with the help of ORY Hydra[0], please check em out. [0]: https://www.ory.sh/hydra/docs/concepts/login https://www.ory.sh/hydra/docs/concepts/login
- lostmsu 5y ago
  The idea is that your OAuth site could let me login with https://example.com/it_is_me_i_swear https://example.com/it_is_me_i_swear as long as I am able to put the token you generated somewhere in that page. Not necessarily with https://news.ycombinator.com/user?id=lostmsu https://news.ycombinator.com/user?id=lostmsu
  - hardwaresofton 5y ago
    Ahhh yep, I’ve actually got some plans for some other sites I could support! If you’re referring more to the possibility of you owning the site itself that’s possible too

nailer 5y ago

Hah I had the idea to do this but not using OpenID (show a token on an account to prove you own it) - kudos to using standards! The use case was stealing the userbase from a stagnant competitor allowing everyone to keep their existing usernames on my platform.

zeepzeep 5y ago

Hey this is neat. Great work, I really like such weird ideas and it looks so professional!

hardwaresofton 5y ago
Thanks for the note :) yeah it was a really quick hack -- it only looks professional thanks to mvp.css[0]! [0]: https://andybrewer.github.io/mvp/ https://andybrewer.github.io/mvp/

voussoir 5y ago

Hi, I just wanted to say I have fond memories of using garrysmod.org to download add-ons for gmod back in 2008-2010 or so. They used the same authentication technique by giving the user a token to put on their Steam profile. I'm still wearing mine! As long as the entity in question (HN, Steam) isn't at risk of going bust, I think this is very practical. Best of luck.

hardwaresofton 5y ago
Thanks, appreciate the note! I actually never got into garrysmod (I basically started with CS: Source then went to CS:GO) so I never saw that, but I'm glad it makes sense and there's some historical precedent I'm not afoul of.

schwede 5y ago

I think it’s in poor taste to theme your site to look like HN. Feels a little close to phishing.

hardwaresofton 5y ago
I did think about it, but I don't think it's too bad -- the site is plastered with "unofficially" and the disclaimer to prevent that. I love how minimal HN is and I don't think I've ever seen orange work this well on a site in my life to be honest, so I wanted to pay a little homage and also have people feel at home. I'll definitely consider changing the theme, and I've already added a disclaimer.