Hacker News Reader

Comment by lstamour | Hacker News Reader

Great, it’s de-centralized OAuth. All we need now is a replacement for the hideous URL login prompt. My preference would be for an AccountChooser-style list of accounts you’ve recently used so you can pick one and sign in—and enter a URL (or email) only if you need to.

View on HN

Unless there's gonna be native browser support, the different websites you visit won't be able to know which accounts you've recently used elsewhere.

If browsers were to support this, there would be some tricky UI/UX questions about how readily the browser provides information to a new website about accounts you have on other sites.

Such a feature might best be specified as an extension to this API:

https://developer.mozilla.org/en-US/docs/Web/API/Credential_...

which although experimental does have some level of browser support.

The web credential API is meant to be an integration point for passwords and AccountChooser in your browser. But I don't know if any other browsers than Chrome plan to implement it.

Don't expose it to the web page, but treat it as a native UI control.

Unless you centralize the list as AccountChooser.com does using Local Storage.

You mention "URL (or email)", so I think it is worth pointing out that there is a standardized way of converting an email address into an HTTP URL, namely WebFinger.

The RFC even includes an example of doing something very similar to this use case:

https://tools.ietf.org/html/rfc7033#section-3.1

The problem is, where do you store this list? The Web doesn’t have a way to store things except at a particular domain, and that domain will then know everything.

Anyone remember xAuth effort led by Meebo and others? It ran into the same objections for using a centralized domain for the time being even though it was great.

Browsers could implement that part of the UI. Like address autofill.

And until then what do we do?

Cry in our beverages of choice.

I made a bookmarklet that will store a url for you, and sign you in. You can create your own at: https://unicyclic.com/usb

The existing AccountChooser interface, which was Google’s preferred SSO strategy until their recent experiments with zero-click SSO, was hosted at AccountChooser.com by the OpenID folks.

Reply on news.ycombinator.com