3 ms·

How it logs me in via HN without having to submit my HN password to a party other than HN (the one thing I was interested in, buried somewhere in the middle of

by Aachen 5y ago

How it logs me in via HN without having to submit my HN password to a party other than HN (the one thing I was interested in, buried somewhere in the middle of the post) is this good old hack: > Provide[s] a unique code or phrase to put in their HN profile

forgotpwd16 5y ago
Yeah, a simple yet effective technique. Had to join a Discord server and they're doing something similar for some other site.
- Aachen 5y ago
  It's also how domain ownership is verified before issuing security certificates. It's used in a lot of places. The title speaks of being a "login with X" which made me expect something else than this manual step, like you could login to HN in a frame and somehow it queried your login status or so. Depending on the CORS headers, that could have been possible but then every site on the Internet can query the same, unless this person talked to HN owners. To me this is just the core interesting part of the story (but then I'm a security person who works with web security on a daily basis). The title isn't intentionally misleading, and it's still a "login with", just not how I was expecting it.
capableweb 5y ago
> How it logs me in via HN without having to submit my HN password to a party other than HN The title is a bit misleading, it doesn't actually "log you into" anything, it just verifies you're the owner of a specific HN account, at least according to https://news.ycombinator.com/item?id=30428282 https://news.ycombinator.com/item?id=30428282
- hombre_fatal 5y ago
  Though you could still implement login this way. You visit /login-with-hn, the server generates a code for your HN profile, you add it to your HN profile, and the server gives you a long-lasting sessionID (e.g. cookie). Where it wouldn't count as "logging in" for me is if you have to first create an account with some credentials and then later link it to HN.
  - capableweb 5y ago
    Yes, you can "login" as in "confirm this is the HN user they say they are", but not "Login as the HN user" as there is no actual connection to HN besides a token in the profile. When someone implements "Login with Google", you get some sort of access to the Google account, the minimum being the email. But this service gives you nothing more than the public view of a HN profile. If someone told me I could "Login with HN", I'd expect things like the ability to post comments/submissions via that account when authenticated, but that's not what's happening here.
    - hombre_fatal 5y ago
      Well, when I log in with Github/Google/Twitter, I don't necessarily need to confer any account access to the website and I almost never do, so I'm not sure that's the defining factor of 3rd party login. At that point, 3rd party login really is just "we'll contact their servers to authenticate you and then give you a session." One example would be StackOverflow which lets you log in with Google/Github/Facebook but doesn't ask for any permissions on those websites.

by Aachen 5y ago

forgotpwd16 5y ago

Yeah, a simple yet effective technique. Had to join a Discord server and they're doing something similar for some other site.

Aachen 5y ago
It's also how domain ownership is verified before issuing security certificates. It's used in a lot of places. The title speaks of being a "login with X" which made me expect something else than this manual step, like you could login to HN in a frame and somehow it queried your login status or so. Depending on the CORS headers, that could have been possible but then every site on the Internet can query the same, unless this person talked to HN owners. To me this is just the core interesting part of the story (but then I'm a security person who works with web security on a daily basis). The title isn't intentionally misleading, and it's still a "login with", just not how I was expecting it.

capableweb 5y ago

> How it logs me in via HN without having to submit my HN password to a party other than HN The title is a bit misleading, it doesn't actually "log you into" anything, it just verifies you're the owner of a specific HN account, at least according to https://news.ycombinator.com/item?id=30428282 https://news.ycombinator.com/item?id=30428282

hombre_fatal 5y ago
Though you could still implement login this way. You visit /login-with-hn, the server generates a code for your HN profile, you add it to your HN profile, and the server gives you a long-lasting sessionID (e.g. cookie). Where it wouldn't count as "logging in" for me is if you have to first create an account with some credentials and then later link it to HN.
- capableweb 5y ago
  Yes, you can "login" as in "confirm this is the HN user they say they are", but not "Login as the HN user" as there is no actual connection to HN besides a token in the profile. When someone implements "Login with Google", you get some sort of access to the Google account, the minimum being the email. But this service gives you nothing more than the public view of a HN profile. If someone told me I could "Login with HN", I'd expect things like the ability to post comments/submissions via that account when authenticated, but that's not what's happening here.
  - hombre_fatal 5y ago
    Well, when I log in with Github/Google/Twitter, I don't necessarily need to confer any account access to the website and I almost never do, so I'm not sure that's the defining factor of 3rd party login. At that point, 3rd party login really is just "we'll contact their servers to authenticate you and then give you a session." One example would be StackOverflow which lets you log in with Google/Github/Facebook but doesn't ask for any permissions on those websites.