3 ms·

See, this is one of many reasons why I'm sad we still use usernames/passwords for so many sites. I'm much more likely to register for a site if it supports 3rd

by Pxtl 3y ago

See, this is one of many reasons why I'm sad we still use usernames/passwords for so many sites. I'm much more likely to register for a site if it supports 3rd-party auth instead of managing another password. It's too bad we don't have a properly open way to do that -- no "auth with this address" but instead a fixed hand-coded list of FB, Google, etc.

babypuncher 3y ago
It sucks that often our only option for this kind of authentication is Facebook or Google, since they only see this as a way to harvest even more data about their users. Apple's implementation is a lot better on this front, but you're still placing your trust in a trillion dollar company. And lots of sites choose not to implement it because Apple's design makes it harder to track users across domains.
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
codetrotter 3y ago
> It's too bad we don't have a properly open way to do that It exists, it’s a web standard, and it’s called WebAuthn https://auth0.com/blog/introduction-to-web-authentication/ https://auth0.com/blog/introduction-to-web-authentication/
dragontamer 3y ago
https://indieweb.org/IndieAuth https://indieweb.org/IndieAuth All we need for "identity" is a webpage that the world reasonably expects us to control. For an extreme example, my "identity" is simply my page at https://news.ycombinator.com/user?id=dragontamer https://news.ycombinator.com/user?id=dragontamer. Because I "control" the page, and because most people have reason to trust dang/Hacker News to not manipulate my "About Page", it serves as an identity. ------- That being said, Hacker News "About" pages probably isn't the best place for a general web identity. But maybe a static-page at "neocities.org", or "Github", etc. etc. serve as an identity in practice.
mostlysimilar 3y ago
Is it really a lot of effort "managing" a password when your browser will literally create, pre-fill, and save those credentials for you? Valid argument in 2003. Not so much in 2023.
- dmd 3y ago
  Sadly outside of the HN crowd something like 5% of people use that functionality of their browser - and maybe 1% use a password manager.
jayelbe 3y ago
OpenID does exactly that and has been a thing for something like 15 years now. Quite a few big sites like Yahoo, Google, AOL Verisign would provide a URL you could login with (they were identity providers) and there were lots of independent providers too. You could easily host your own with as simple PHP script. Sadly, fewer large sites would actually accept OpenID as a way of logging in, but you could used OpenID for authenticating Blogger comments. Stackexchange supported OpenID logins for 8 years [until July 2018](https://meta.stackexchange.com/questions/307647/support-for-openid-ended-on-july-25-2018 https://meta.stackexchange.com/questions/307647/support-for-...). The BBC wrote quite a good summary of how things stood in 2008: https://www.bbc.co.uk/blogs/bbcinternet/2008/10/openid_foundation_meeting_what.html https://www.bbc.co.uk/blogs/bbcinternet/2008/10/openid_found... It's another one of those sad parts of the web we lost.

by Pxtl 3y ago

babypuncher 3y ago

It sucks that often our only option for this kind of authentication is Facebook or Google, since they only see this as a way to harvest even more data about their users. Apple's implementation is a lot better on this front, but you're still placing your trust in a trillion dollar company. And lots of sites choose not to implement it because Apple's design makes it harder to track users across domains.

deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

codetrotter 3y ago

> It's too bad we don't have a properly open way to do that It exists, it’s a web standard, and it’s called WebAuthn https://auth0.com/blog/introduction-to-web-authentication/ https://auth0.com/blog/introduction-to-web-authentication/

dragontamer 3y ago

https://indieweb.org/IndieAuth https://indieweb.org/IndieAuth All we need for "identity" is a webpage that the world reasonably expects us to control. For an extreme example, my "identity" is simply my page at https://news.ycombinator.com/user?id=dragontamer https://news.ycombinator.com/user?id=dragontamer. Because I "control" the page, and because most people have reason to trust dang/Hacker News to not manipulate my "About Page", it serves as an identity. ------- That being said, Hacker News "About" pages probably isn't the best place for a general web identity. But maybe a static-page at "neocities.org", or "Github", etc. etc. serve as an identity in practice.

mostlysimilar 3y ago

Is it really a lot of effort "managing" a password when your browser will literally create, pre-fill, and save those credentials for you? Valid argument in 2003. Not so much in 2023.

dmd 3y ago
Sadly outside of the HN crowd something like 5% of people use that functionality of their browser - and maybe 1% use a password manager.

jayelbe 3y ago

OpenID does exactly that and has been a thing for something like 15 years now. Quite a few big sites like Yahoo, Google, AOL Verisign would provide a URL you could login with (they were identity providers) and there were lots of independent providers too. You could easily host your own with as simple PHP script. Sadly, fewer large sites would actually accept OpenID as a way of logging in, but you could used OpenID for authenticating Blogger comments. Stackexchange supported OpenID logins for 8 years [until July 2018](https://meta.stackexchange.com/questions/307647/support-for-openid-ended-on-july-25-2018 https://meta.stackexchange.com/questions/307647/support-for-...). The BBC wrote quite a good summary of how things stood in 2008: https://www.bbc.co.uk/blogs/bbcinternet/2008/10/openid_foundation_meeting_what.html https://www.bbc.co.uk/blogs/bbcinternet/2008/10/openid_found... It's another one of those sad parts of the web we lost.