4 ms·

> How it logs me in via HN without having to submit my HN password to a party other than HN The title is a bit misleading, it doesn't actually "log you into" a

> How it logs me in via HN without having to submit my HN password to a party other than HN The title is a bit misleading, it doesn't actually "log you into" anything, it just verifies you're the owner of a specific HN account, at least according to https://news.ycombinator.com/item?id=30428282 https://news.ycombinator.com/item?id=30428282

hombre_fatal 5y ago
Though you could still implement login this way. You visit /login-with-hn, the server generates a code for your HN profile, you add it to your HN profile, and the server gives you a long-lasting sessionID (e.g. cookie). Where it wouldn't count as "logging in" for me is if you have to first create an account with some credentials and then later link it to HN.
- capableweb 5y ago
  Yes, you can "login" as in "confirm this is the HN user they say they are", but not "Login as the HN user" as there is no actual connection to HN besides a token in the profile. When someone implements "Login with Google", you get some sort of access to the Google account, the minimum being the email. But this service gives you nothing more than the public view of a HN profile. If someone told me I could "Login with HN", I'd expect things like the ability to post comments/submissions via that account when authenticated, but that's not what's happening here.
  - hombre_fatal 5y ago
    Well, when I log in with Github/Google/Twitter, I don't necessarily need to confer any account access to the website and I almost never do, so I'm not sure that's the defining factor of 3rd party login. At that point, 3rd party login really is just "we'll contact their servers to authenticate you and then give you a session." One example would be StackOverflow which lets you log in with Google/Github/Facebook but doesn't ask for any permissions on those websites.

4 ms·

> How it logs me in via HN without having to submit my HN password to a party other than HN The title is a bit misleading, it doesn't actually "log you into" a

by capableweb 5y ago

hombre_fatal 5y ago
Though you could still implement login this way. You visit /login-with-hn, the server generates a code for your HN profile, you add it to your HN profile, and the server gives you a long-lasting sessionID (e.g. cookie). Where it wouldn't count as "logging in" for me is if you have to first create an account with some credentials and then later link it to HN.
- capableweb 5y ago
  Yes, you can "login" as in "confirm this is the HN user they say they are", but not "Login as the HN user" as there is no actual connection to HN besides a token in the profile. When someone implements "Login with Google", you get some sort of access to the Google account, the minimum being the email. But this service gives you nothing more than the public view of a HN profile. If someone told me I could "Login with HN", I'd expect things like the ability to post comments/submissions via that account when authenticated, but that's not what's happening here.
  - hombre_fatal 5y ago
    Well, when I log in with Github/Google/Twitter, I don't necessarily need to confer any account access to the website and I almost never do, so I'm not sure that's the defining factor of 3rd party login. At that point, 3rd party login really is just "we'll contact their servers to authenticate you and then give you a session." One example would be StackOverflow which lets you log in with Google/Github/Facebook but doesn't ask for any permissions on those websites.