Hacker News Reader

Comment by Justsignedup | Hacker News Reader

A smart use of "save password" is where you authenticate and store the login token locally. You can then log in without a password, but also your session can be invalidated any time you say... change your password, or ask for a session to be kicked off.

We have to do this with web apps all the time. Nobody stores passwords in local browser store.

View on HN

I don't know if that applies to TV's circumstances because you can use the client to connect to endpoints without either end being internet accessible.

TeamViewer does operate account infrastructure like you're describing, but that isn't exclusively what they offer. They do point-to-point too.

I don't see how network position relates to the authentication scheme. As far as I can see, these are entirely separate issues, handled at different layers of the OSI stack.

The TV host could issue its own persistent tokens, no internet access required.

Yes, looking at this page it’s possible to disconnect the client from Team Viewer’s online infrastructure entirely: https://community.teamviewer.com/t5/Knowledge-Base/Can-TeamV...

> Hint: If you choose Accept exclusively, TeamViewer will disconnect from the internet – that means it will no longer be possible to make or receive connections using the TeamViewer ID, and the Computer & Contacts list will no longer be available.

^this. i recently had to explain this to a product manager who wanted the user's email and password to be autofilled it they landed at the login page.

I’ve actually seen that functionality in the wild. Quite horrible. IIRC it was some weird open source web app.

It's not the same thing at all. TeamViewer literally has to take in the password and paste it plaintext in later. They cannot simply validate that a user knows the password.

This does not happen "all the time" in web dev.

That's a cool idea for a web service where once someone tries to actually change something, you can ask again for the password. I struggle to see how it makes any sort of difference for a remote management software; it's essentially an enterprise ready trojan. The moment someone has connected to a machine through token or password, that machine is utterly compromised and can not be saved by you clicking "revoke" in a web interface. That kinda situation calls for you to physically disconnect the machine from power.

> Nobody stores passwords in local browser store.

Yes, quite many body do:

chrome://settings/passwords

He's talking about web apps

And TeamViewer isn't a web app. The parent is just demonstrating how other local, non-web apps have exactly the same issue for the same reason

deep tangle

Reply on news.ycombinator.com