3 ms·

The whole concept of being logged in (cookied with some user_id) or not is so fundamental to web apps I wonder… If we were making the HTML spec today… can you i

The whole concept of being logged in (cookied with some user_id) or not is so fundamental to web apps I wonder… If we were making the HTML spec today… can you image a world where the login sign up and forgot password features were in the GUI of the browser itself? Completely independent of the rendered HTML and no web developer would ever have to work those buttons into the design. They would be like the HOME or BACK buttons.

nicoburns 4y ago
> If we were making the HTML spec today… can you image a world where the login sign up and forgot password features were in the GUI of the browser itself? This kinda exists as "basic auth". The UI is just terrible so nobody uses it. It's not a button though. A button would be pretty nice to be fair.
- eterm 4y ago
  I think the security of basic auth killed it off. 1. Usernames and passwords sent clear text in URLs. 2. Hijacking is worse than cookie hijacking because you get the permanent credentials with no way to force session invalidation 3. Credentials would be cached (and visible) in browser history It was a byproduct of the early web and isn't fit for purpose.
  - yamtaddle 4y ago
    Credentials are sent in headers, and http-auth supports a bunch of schemes other than basic. Browsers have (shitty) UI for taking the username and pass, you don't have to put it in the address bar (and that's been discouraged for years and years). There's no reason whatsoever the feature couldn't have been improved and promoted over the years such that there would rarely be a reason to use anything else. The Web's failure here has been a remarkably expensive misstep for the software economy.
    - qbasic_forever 4y ago
      There's no concept of forgot my password or ID with browser auth. People tried using it years and years ago and it just never evolved into something usable by the general public.
      - yamtaddle 4y ago
        Yes, it definitely should have been maintained and improved over the years.
qbasic_forever 4y ago
Identity is hard. What is the ID you'd mandate for every website on the internet? Your bank might use your email, but your retirement accounts probably use SSN. Your message board might use a made up handle (and you don't even want it to know an email associated with you). Modern services might be using a passkey/webauthn hardware device. Some sites even have multiple identity fields, like I have bank accounts that I have to specify id/email and type of account (personal, professional, etc.) to login. The point is there isn't any single concept of identification or principle that can work for everything on the web.
- andrewfromx 4y ago
  You can still handle all those cases but just with three new buttons in the browser itself. Users would never have to find the login link buried in the footer or forget password only available after you fail a login. Web developers would implement where to go on each button click and unimplemented clicks on these three buttons would be like a 404 and considered broken.
  - qbasic_forever 4y ago
    Forgot password isn't enough, what if I forgot my login ID? But then it circles back to my point--what _is_ an identity? Would the button say 'forgot email'? But not every site uses email as principle ID... It gets even more complicated when I have multiple accounts. Who lets me pick what account I want to use? Is the site responsible for that, or does the browser now need a concept of storing multiple IDs (whatever they might be) and managing them? It gets extremely complicated extremely fast.

nicoburns 4y ago

> If we were making the HTML spec today… can you image a world where the login sign up and forgot password features were in the GUI of the browser itself? This kinda exists as "basic auth". The UI is just terrible so nobody uses it. It's not a button though. A button would be pretty nice to be fair.

eterm 4y ago
I think the security of basic auth killed it off. 1. Usernames and passwords sent clear text in URLs. 2. Hijacking is worse than cookie hijacking because you get the permanent credentials with no way to force session invalidation 3. Credentials would be cached (and visible) in browser history It was a byproduct of the early web and isn't fit for purpose.
- yamtaddle 4y ago
  Credentials are sent in headers, and http-auth supports a bunch of schemes other than basic. Browsers have (shitty) UI for taking the username and pass, you don't have to put it in the address bar (and that's been discouraged for years and years). There's no reason whatsoever the feature couldn't have been improved and promoted over the years such that there would rarely be a reason to use anything else. The Web's failure here has been a remarkably expensive misstep for the software economy.
  - qbasic_forever 4y ago
    There's no concept of forgot my password or ID with browser auth. People tried using it years and years ago and it just never evolved into something usable by the general public.
    - yamtaddle 4y ago
      Yes, it definitely should have been maintained and improved over the years.

qbasic_forever 4y ago

Identity is hard. What is the ID you'd mandate for every website on the internet? Your bank might use your email, but your retirement accounts probably use SSN. Your message board might use a made up handle (and you don't even want it to know an email associated with you). Modern services might be using a passkey/webauthn hardware device. Some sites even have multiple identity fields, like I have bank accounts that I have to specify id/email and type of account (personal, professional, etc.) to login. The point is there isn't any single concept of identification or principle that can work for everything on the web.

andrewfromx 4y ago
You can still handle all those cases but just with three new buttons in the browser itself. Users would never have to find the login link buried in the footer or forget password only available after you fail a login. Web developers would implement where to go on each button click and unimplemented clicks on these three buttons would be like a 404 and considered broken.
- qbasic_forever 4y ago
  Forgot password isn't enough, what if I forgot my login ID? But then it circles back to my point--what _is_ an identity? Would the button say 'forgot email'? But not every site uses email as principle ID... It gets even more complicated when I have multiple accounts. Who lets me pick what account I want to use? Is the site responsible for that, or does the browser now need a concept of storing multiple IDs (whatever they might be) and managing them? It gets extremely complicated extremely fast.