Hacker News Reader

Comment by tptacek | Hacker News Reader

This works because Apple is in the reversing arms race. Does it make sense for Dropbox to go down this path? Note that Google and your bank don't.

View on HN

Banks absolutely do this once they have the ability to talk to the OS. I've built 3 banking apps for iphone/ipad now and client side verification was involved in all of them after first login.

The problem is browsers just don't have a good standard way of accomplishing this.

All my banks do. If they detect a browser/IP that I haven't used before they ask me for another piece of authentication (secret question)

I think we're talking past each other here. I thought we were talking about embedding secrets in machines. If you want a button in the Dropbox UI that tells it to freak out when your IP changes, that's fine; I think there's a good reason Gmail doesn't default that way though.

Blizzard freaks out about changing IP addresses when you sign in to World of Warcraft. I have two internet connections at home and sometimes I switch back and forth, and back when I was playing WoW, it would lock me out after each switch. I had to login to my account via the battle.net website and stell it that everything was ok.

It was extremely annoying. The last few times it happened I just didn't play for a while because I didn't want to bother with reauthenticating; that's when I realized that I didn't enjoy the game that much any more and cancelled my account.

for the sake of counter-example: facebook does. E.g. if you try to log in from a different country than ones it already knows you have to go through a long process of reauthentication by inputting your friends' names based on pictures. At least, it happened to me twice.

Reply on news.ycombinator.com