6 ms·
How I Built LoginWithHN
- sleepychu 5y agoNeat, interesting read :-) I gave loginwithhn a go, I'd recommend getting the user to type in the OTP. Checks their generation method is correct and makes sure they've managed to grab the secret before locking them out of future logins.
- hardwaresofton 5y agoGreat suggestion! This is not the first time it's been suggested either, I'm going to look into it!
- capableweb 5y agoIt's a bit unclear what details you get as an application developer when using LoginWithHN. Is it just to verify that a user is also a user of HN? Or do I get the news.ycombinator.com token so I can build HN clients that are able to post comments as the user?
- hnlmorg 5y agoThis is just a 3rd party service (not affiliated with HN) checking peoples HN profiles (which are public) for a unique string that the 3rd party service asks said user to set. It's a bit like how custom domains names are added to (for example) GSuite email. As an application developer, you get no access to HN because the 3rd party service doesn't have any access to HN to begin with. It's all just a clever workaround to validate "ownership" of a HN profile.
- Aachen 5y agoHow it logs me in via HN without having to submit my HN password to a party other than HN (the one thing I was interested in, buried somewhere in the middle of the post) is this good old hack: > Provide[s] a unique code or phrase to put in their HN profile
- forgotpwd16 5y agoYeah, a simple yet effective technique. Had to join a Discord server and they're doing something similar for some other site.
- Aachen 5y agoIt's also how domain ownership is verified before issuing security certificates. It's used in a lot of places. The title speaks of being a "login with X" which made me expect something else than this manual step, like you could login to HN in a frame and somehow it queried your login status or so. Depending on the CORS headers, that could have been possible but then every site on the Internet can query the same, unless this person talked to HN owners. To me this is just the core interesting part of the story (but then I'm a security person who works with web security on a daily basis). The title isn't intentionally misleading, and it's still a "login with", just not how I was expecting it.
- capableweb 5y ago> How it logs me in via HN without having to submit my HN password to a party other than HN The title is a bit misleading, it doesn't actually "log you into" anything, it just verifies you're the owner of a specific HN account, at least according to https://news.ycombinator.com/item?id=30428282 https://news.ycombinator.com/item?id=30428282
- hombre_fatal 5y agoThough you could still implement login this way. You visit /login-with-hn, the server generates a code for your HN profile, you add it to your HN profile, and the server gives you a long-lasting sessionID (e.g. cookie). Where it wouldn't count as "logging in" for me is if you have to first create an account with some credentials and then later link it to HN.
- capableweb 5y agoYes, you can "login" as in "confirm this is the HN user they say they are", but not "Login as the HN user" as there is no actual connection to HN besides a token in the profile. When someone implements "Login with Google", you get some sort of access to the Google account, the minimum being the email. But this service gives you nothing more than the public view of a HN profile. If someone told me I could "Login with HN", I'd expect things like the ability to post comments/submissions via that account when authenticated, but that's not what's happening here.
- adrianwaj 5y agoCould you also setup an HN cryptocurrency (or token) and grant units according to karma and account age please (or whatever other factors you deem important)? - let's see what happens then to all the crypto skeptics around here. An about-face?
- WrtCdEvrydy 5y agoYeah, we need NFTs of your login so we can sell those.
- akselmo 5y agoAdd an ugly monkey on your profile information!
- andrewfromx 5y agoWoah woah woah. Too far. Every monkey is beautiful.
- akselmo 5y agoThe one I see in the mirror every morning disagrees.
- _Algernon_ 5y agoConsidering what moons did to the quality of discussion on various crypto subreddits, I think it is fair to say that this is a really bad idea, no matter what side of the crypto debate you stand on. At least if you appreciate HN discussions.
- Aachen 5y agoWhat's a moons? I'm out of the loop, apparently
- _Algernon_ 5y ago
- cactusbee 5y agoFun idea! Didn't work for me tho.
- DangitBobby 5y agoCan you elaborate on how it didn't work for you?
- kaan_keskin 5y agoI put the phrase in my profile but it couldn't complete the validation in a couple of minutes. Probably same issue.
- cactusbee 5y agoExactly! I guess it was hugged to death by HN.
- mariusmg 5y agoDoes HN has OpenID Connect support to integrate from another website ?
- Aachen 5y agoApparently not or they'd have used that right?
- yannikyeo 5y agoJust curious what’s the advantage of using Ory stack, which is more work that requires you to develop the front end, rather than with Keycloak or Authentik that you just customise the front end template?
- hardwaresofton 5y agoThe advantage of ORY was that it required this somewhat custom frontend (since it's not password based) -- I'm not sure how much easier that would have been with Keycloak (my guess is it would have been harder), and I haven't used Authentik before so I'm not sure. Keycloak is definitely more setup and a bit more clunky. I've never deployed Authentik though, I really need to kick the wheels on it and see how it works. BTW in the simple auth/login space there is also: - Keratin[0] - GoTrue[1] (and Supabase's improved version[2]) - Authelia[3] [0]: https://keratin.github.io/authn-server/#/ https://keratin.github.io/authn-server/#/ [1]: https://github.com/netlify/gotrue https://github.com/netlify/gotrue [2]: https://github.com/supabase/gotrue https://github.com/supabase/gotrue [3]: https://github.com/authelia/authelia https://github.com/authelia/authelia
- JimRyan 5y agoHas anyone built something like this (A service which checks the account description to verify ownership) for PlayStation Network? I know that psnprofiles have this kind of system in place, but I couldn't find a public project.
- guessmyname 5y agoPlayStation Network already does OAuth2. Here is an example of a website making use of it → https://accounts.klei.com/login https://accounts.klei.com/login
- zeroxfe 5y agoI sidestepped a whole bunch of user/password management/verification complexity by restricting my toy app (https://pitchy.ninja https://pitchy.ninja) to "login via email" where you get sent a code anytime you need to log in. I wasn't sure about how well it would work when I first launched it, but now, about a year and a half later, I'm really happy with it. The biggest advantages are: I'm not tied to an SSO provider, I don't have deal with password management/security/reset/etc., and I have a super simple UX (identical flows for signup and login.)
- TrueGeek 5y agoI'm doing the same, but using Auth0 for the login-by-email. I don't think it'll really tie me to anything since it would be trivial to change to another service. What did you use to implement yours?
- zeroxfe 5y agoI got an SMTP gateway from AWS: https://aws.amazon.com/ses/ https://aws.amazon.com/ses/
- huhtenberg 5y agoIt'd be prudent to have an option of a backup email address, in case the primary one on file dies or becomes unavailable.
- errantmind 5y agoThis is only possible if you store client state, like the primary email address. I use the same approach to the above, where users authenticate with an email address. I don't store any client state on the server though which is nice for regulations like GDPR. I have 'logged in' users without storing a single piece of data about them! No tracking nor performance stats on the site either.
- huhtenberg 5y agoWhat's the point of having them log in in the first place then?
- gavinray 5y ago> this.ongoingPolls.set(hnUsername, displayToken); Instead of creating a timer + poll loop per user on your server, why not use one single scheduled job and an array of usernames? Seems like debugging +10,000 interval timers could get hairy
- hardwaresofton 5y agoYou're right, that would be way more efficient -- it actually wasn't a huge problem, so I never found the need to combine them. So far we've had 700+ people log in (probably more after this post hit front page, I need to check), and so far it hasn't been a huge issue.
- wyldfire 5y ago> Not every HN user is a YC founder Not every HN user? Oh wow. So, like, only 80% of us? I guess I assumed that the vast majority of us were not founders. How many of you are founders?