Hacker News Reader

Comment by zaroth | Hacker News Reader

Just a thought on the auto-login functionality...

If I run an intercepting proxy and alter all instances of my username in the HTML response from HN servers to appear in every way to be logged in as 'dang'.... How would your extension detect the forgery?

View on HN

Glad you asked! So here is a teaser on how it works: 1. ClapChat gives you a unique id, the extension posts the id in your profile, ClapChat independently verifies that your profile contains the correct ID so that we know you really do own the account, then we double check the ID vs the session that we gave the id to and we can validate the authorization.

I'm working on a blog post that goes into much further detail and will post soon.

In a way, it's kind of like validating a domain name using a TXT record.

Btw, we also plan on open sourcing all this. So everyone will be able to give feedback and contribute. The hope is it becomes a really useful tool for the community

Neat. I remember my days on Something Awful Forums and many did the same thing for various integrations. Ten years later the technique still works.

You should offer HN Auth As a Service/Platform so that others can easily build around it and users can easily auth into others services.

Here is an early diagram I made when we were exploring the idea. It's not the complete story but hopefully it communicates the general idea https://s3-us-west-1.amazonaws.com/www.clap.chat/assets/HN-a...

Reply on news.ycombinator.com