3 ms·
Wouldn't it make more sense to store a blob containing the username, signed by loginwithhn in the profile. Something like HMAC(secret_kept_by_loginwithhn, usern
by dividuum 5y ago
Wouldn't it make more sense to store a blob containing the username, signed by loginwithhn in the profile. Something like HMAC(secret_kept_by_loginwithhn, username). Upon authorization, check if the blob is properly signed and matches the requested username. That way you'd only have to place it once and copying it between profiles isn't possible. I'm probably overlooking something.
- rgovostes 5y agoSuppose you have logged into HN this way and so the token is in your profile. What would prevent me from logging in as dividuum?
- dividuum 5y agoNothing. You are correct of course and my suggestion is fatally flawed. Can’t edit my comment unfortunately. Guess that’s a reminder not to do half-assed protocol engineering while watching Netflix :-}
- jtsiskin 5y agoThis trusts loginwithhn. The metamask way can be used by any site and only need to trust hacker news.