3 ms·

It started out as a clone of http://nightchamber.com http://nightchamber.com. That functionaluty was simple to emulate. Now I am trying to build a complete logi

It started out as a clone of http://nightchamber.com http://nightchamber.com. That functionaluty was simple to emulate. Now I am trying to build a complete loginless social network. Although, the logging in process is highly device dependent, it will involve making the user approve the devices he intends to use the network from. What's fun is the number of ways I had to come up with that will make sure that the correct user is logged in regardless of the device he accesses it from. Its on github: http://github.com/arkokoley/nightowl http://github.com/arkokoley/nightowl

privacythrow 11y ago
Seems you're building an authentication mechanism which is based on private links. You should keep in mind that with services like similarweb.com, which steal users click-stream using a number of extensions that sell them this data, the concept of private links no longer esxists. Open a link in your browser, an extension sends it to similarweb.com, and the "private" url will be displayed on their dashboard, to their premium users.
- arkokoley 11y ago
  The authentication mechanism actually uses cookies, that don't expire for a long time, to authenticate the user. Private links come in when the user wants to log in via a device which he does not usually use.
alexmobile 11y ago
Interesting... Care to explain the concepts behind your loginless auth? In a sentence or two? Thanks! (do not have time to go through code myself :( )
- arkokoley 11y ago
  Whenever a user visits the website, a session cookie is created in the user's system, that is set to expire after 15 years. Using this cookie data, I identify and authenticate the user. The user also has a private url which he can use to login using other devices. Once logged in from this unidentified device, another cookie is created for the user but with a short time span. The user has the option to set the device as trusted which will result in the cookie expiry to be set at 15 years.
  - alexmobile 11y ago
    OK, got it. You probably ask for user's email and send them their secret special link that could be used over and over to restore the cookie? in case if they accidently delete their cookie?
    - arkokoley 11y ago
      Not yet. Currently the user has to make sure to save that link. There is no recovery if they delete the cookie and have no access to the secret link. This idea originated from NightChamber which refrains from asking for any kind of user details to maintain anonymity. But that might have to change with my implementation because of the social network like features. Emailing the secret link seems good, now that I think about it. Thanks!

privacythrow 11y ago

Seems you're building an authentication mechanism which is based on private links. You should keep in mind that with services like similarweb.com, which steal users click-stream using a number of extensions that sell them this data, the concept of private links no longer esxists. Open a link in your browser, an extension sends it to similarweb.com, and the "private" url will be displayed on their dashboard, to their premium users.

arkokoley 11y ago
The authentication mechanism actually uses cookies, that don't expire for a long time, to authenticate the user. Private links come in when the user wants to log in via a device which he does not usually use.

alexmobile 11y ago

Interesting... Care to explain the concepts behind your loginless auth? In a sentence or two? Thanks! (do not have time to go through code myself :( )

arkokoley 11y ago
Whenever a user visits the website, a session cookie is created in the user's system, that is set to expire after 15 years. Using this cookie data, I identify and authenticate the user. The user also has a private url which he can use to login using other devices. Once logged in from this unidentified device, another cookie is created for the user but with a short time span. The user has the option to set the device as trusted which will result in the cookie expiry to be set at 15 years.
- alexmobile 11y ago
  OK, got it. You probably ask for user's email and send them their secret special link that could be used over and over to restore the cookie? in case if they accidently delete their cookie?
  - arkokoley 11y ago
    Not yet. Currently the user has to make sure to save that link. There is no recovery if they delete the cookie and have no access to the secret link. This idea originated from NightChamber which refrains from asking for any kind of user details to maintain anonymity. But that might have to change with my implementation because of the social network like features. Emailing the secret link seems good, now that I think about it. Thanks!