4 ms·
Great idea. If you need to add a code to your bio, another idea is putting a public key in your HN bio and signing a nonce message using some browser extension
by udbhavs 5y ago
Great idea. If you need to add a code to your bio, another idea is putting a public key in your HN bio and signing a nonce message using some browser extension like Metamask.
- Anunayj 5y agoOr just storing the key in browser with Web Crypto API (or localStorage cuz safari ffs). Ofc this means the key is only scoped to their domain.
- dividuum 5y agoWouldn't it make more sense to store a blob containing the username, signed by loginwithhn in the profile. Something like HMAC(secret_kept_by_loginwithhn, username). Upon authorization, check if the blob is properly signed and matches the requested username. That way you'd only have to place it once and copying it between profiles isn't possible. I'm probably overlooking something.
- rgovostes 5y agoSuppose you have logged into HN this way and so the token is in your profile. What would prevent me from logging in as dividuum?
- dividuum 5y agoNothing. You are correct of course and my suggestion is fatally flawed. Can’t edit my comment unfortunately. Guess that’s a reminder not to do half-assed protocol engineering while watching Netflix :-}
- jtsiskin 5y agoThis trusts loginwithhn. The metamask way can be used by any site and only need to trust hacker news.