Hacker News Reader

Comment by mrtksn | Hacker News Reader

I don't understand why people even ask for account creation. Now days the devices are personal, you don't have to have accounts to be identified, they are only good to sync between devices(like multiple devices and account restoration). Especially with apps, the moment you install the app you have your details there for good and they don't go away accidentally like with the browsers.

I assume it's about tracking but now I'm beginning to suspect that it's simply a cargo cult mentality where no body asks why are we doing this.

I don't proceed with anything that requires a form to be filled without having a good reason. I'm actually positive that I have a bank account that doesn't have a login info, when I need to sign in from another device I would simply scan a barcode from the app to let me in.

Yet, there are apps asking me more questions than an immigration officer to let me use it.

View on HN

> you have your details there for good and they don't go away accidentally like with the browsers.

But when it does go away (app reinstalls, phone upgrades, phone breaks etc), it causes a disproportionately catastrophic event: complete loss of access. Providing a simple email address would prevent this, but expecting the common user to have the wisdom on account recovery strategies is too optimistic. That's why many apps ask for email during registration.

That can be tolerable for Discord, because your loss is just your friends list and access to some servers, which can be recovered easily through social means. That's not possible or feasible for every kind of app.

You can always let the person in and let them get started (you know, the valuable stuff that actually causes retention), and then prompt them 24 hours later to enter an email address or phone number for account recovery purposes.

Or give them a choice to create an account if they want to but not needlessly bug them about it.

Discord basically copied IRC and added voice chat. One didn't need an account for IRC why should they need one on Discord? Maybe to retain their nickname but that's it. And it was just a password, no email no phone number no nothing else.

I really liked the temporary and anarchic nature of IRC. No one was really in control.

I'm in the other camp on this one. I think the best thing to happen to IRC were the services that let you keep your nick or your channel without needing to maintain an army of bots. Channel takeovers on EFnet were a fact of life and it made things pretty unpleasant imo.

You created another nick or another channel and moved on with life. I liked EFnet, although the conversation got disrupted by troublemakers all the time, I met some really interesting people on it. Freenode was also too nice with nick registration and nicer people and no stinking IRC network task force on the channels like on UnderNet. You totally had the option to be a nomad or register a nickname or a channel.

The next logical step would have been to make it encrypted and add p2p voice chat via DCC or some other method. SILC tried the former but failed to gain traction, people either stuck with IRC or moved on to AIM and Yahoo Messaneger.

I don't see the similarity you draw between IRC and Discord, other than the fact they both have text chat. If you think nobody was really in control of IRC then you must have missed out on some of the structure. https://en.wikipedia.org/wiki/IRC_operator#Operator_types

IRC is federated. Most of the ops were volunteers. They were technically in control of the network until troblemakers launched DoS attacks and caused a split in order to take over channels. Discord has a very similar interface to most IRC clients.

If nag me with providing personal information afterwards I will stop using your app/website. Not being upfront about the kind of information you require comes off as extremely scummy.

From layman’s perspective it’s easy to reason that deleting an app or loosing the device will result in loose of data.

You can easily offer an optional data safeguard feature for account restoration.

So you'd assume this but older members of my family regular seem to not understand this. Either they just assume that their phone number is their "account" or in some cases make no distinction between the app and their account. They installed the app so where did their data go?

This is especially pronounced now that application sync between devices is more or less universal on iOS and (to a lesser extent) Android.

To the layman, the intuitive perspective is that it "just works" and is exactly how they left it previously, regardless of whether they have wiped their phone or replaced it. This isn't a dig at tech illiterate people but it is just how things are for the normal person. Hell I have been almost burned by this in the past when I moved phones and a certain app(FGO)'s data didn't transfer over.

TLDR The most intuitive thing is working out of the box and seamlessly transferring to a new device. The easiest way to do this is to allow it to be bound to a user's Google account, Microsoft account, and Apple ID.

Japanese phone carriers had carrier specific mechanisms that plain HTTP requests invoked from link in HTML with certain parameters gets captured by a proxy to include subscriber ID for authentication.

Those little security-by-securing-all-handset mechanisms kind of worked while there weren’t any publicly known rooted phone, in the wild, that can establish a session on featurephone APN, but emergence of iPhone and Android extinguished it.

This (partly) exists for some mobile carriers.

I know of at least one carrier, but is only usable for their own customer self care portals/apps. There it is possible to auto-login to their app if it is accessed via their network and not via Wi-Fi. For security reasons only a limited amount of functionality is accessible. Neither customer data can be changed nor can any actions resulting in additional cost (buying packs / options) be performed without additional authentication mechanism of a higher security level (auto-login via SMS or use of a password).

The MSISDN is only added to the HTTP request internally in their secure network and never exposed externally.

Actually, that sounds kind of a good idea to me.

Like, have http://my.number/ return the phone number for identification (though it would need some permission, I don't want every app to have access to it).

Make a HTTP POST with some data to http://my.number/validate and have it signed by the carrier, validate it against a list of public keys per carrier. Not sure why that wouldn't work today? It could even be a private/reserved IP address routed by all carriers to their auth service.

Edit: obviously, it wouldn't work over Wi-Fi without some cooperation at the OS level.

so you mean registering with your phone or email?

For games, there’s Game Center in iOS. If that’s not an option, you can provide an option for the user to enter their e-mail, phone number or use “sign in with” service. Usually you can put it in the settings together with a badge seeking their attention.

The idea is that, they already created an account by launching your code, so you don’t have to ask for account creation. Just ask for the information that is necessary to run your services and you can provide an optional method for account recovery.

As a user who has switched back and forth between iOS and Android multiple times, Game Center isn’t gonna cut it for me. But I see how it could be enticing in some use cases.

I currently use an email based signin for a site I maintain, which doesn't require a password. (Scheme described here - http://sriku.org/blog/2017/04/29/forget-password/ ) I don't think I understand the full consequences of reducing the steps for this even more, but am very curious to consider. I do need to maintain a sense of continued identity across machines and need to communicate with the users outside of the site, as my users expect that (and email serves that well). I think it is already fairly simple (relatively). What would be an approach to simplify this even more?

Hmm not sure I am a fan of custom logins everywhere...you say as a user it is 'simpler' but its simple like fast food is simple - low effort but I still have to take out the digital trash persay.

Probably better if the browser started to come with an e-mail set in it - then web admins can query for that and users have the option to change the email when they so choose...

Lots of apps that don't require a sign-in just give you a code that allows you to re-attach to all your saved data. It does require the user to save the code, but that's not super hard.

Nobody said it was hard. But what's your percentage of people that will "save the code" in a document and remember where it is X months/years from now? But everyone will still have their email for the most part.

Saving the code for some random app? No way. I'm too lazy to save a restoration code for my gmail account...

Alternative you can link an email without it being a necessary condition.

If its opt in 90% of people wont do it and near 100% of users will change their device in 1-4 years. 90% of your users will end up losing access to their account and 50%+ will stop using your service in frustration because of creators design flaw. Sign in with google is already almost as easy you don't have to have an actual account creation flow just a button click and a screen where users browser autofills their password and they click login. 2 clicks and 10 seconds.

I don’t know about android but on iOS, restoring the new device through an iCloud backup will bring back the app data too.

So, the users who switch from iphone to an iphone don’t loose anything if they follow the default upgrade process.

How many services do you use even if occasionally and how much toleration do you have for cleverly different things like magically knowing who you are based on device with some way to link an account after the fact. I have zero. I want things to work like other things work. I don't have time nor desire to figure out the non obvious way things work just because the dev is confused about how special they are.

That’s not the case here. Think of this as each app having a folder in your iCloud disk without being able to see other apps from different developers. As long as you don’t delete the app, the folder comes with you as you move from device to device so the apps installation is not required each time.

Also, lockin...

Sounds great while iCloud is up/you use iOS...prepare for the shitestorm when its not or the user decides to leave Apple... 'Easy' and 'Convenient' won't be the terms anyone is using.

That indeed sounds great for people using ios but 90% of users aren't

I'm pretty confident you could change those numbers with a few reminders to link your email/whatever for a backup. My WA account is extremely aggressive about setting backups, so clearly it works (but you don't need to be that aggressive. You can still respect users and remind them of things.)

I'm pretty sure that if you learn the basics of stitching you will be able to close up the wound after you shoot yourself in the foot.

Give them a popup like "link your email to keep your data even after you switch devices"! Don't give them a cancel option though. Give them a "I want to lose my data" option. That will make them think.

Yep and this could be enhanced further by provide a code retrieval service by email, plus facilities to change the code.

You're assuming a lot, especially about the willingness to install an app at all. I won't install an app unless it couldn't actually have been a webapp and I use it really often.

Give me a proper website with a proper email/password/WebAuthN & SSO signup. I don't want the app, I don't want any of it.

He's assuming a non-tech savvy user. Catering to the 1% wouldn't really make for mass market appeal.

Sure, I’m talking from my perspective.

Websites are simply apps installed in the browser without asking for permission. Notorious for tracking abilities, data storage tied to the browser, performance lower, capabilities limited to browser api, data consumption unpredictable, identification tied to web technologies.

Some people may want just that, I don’t judge.

> Websites are simply apps installed in the browser without asking for permission

That actually work on the platforms I choose. There are many apps that only work on iOS/Android that I want to run on my desktop or a more pure linux phone. I just want to be able to consume a service from a platform that clearly have the technical capabilities to do so, but no, it has to be a "app".

> Notorious for tracking abilities

And a lot easier to chose/disable them. This summer many apps (including stuff like spotify) would not even start on iOS because the facebook SDK crashed. On the spotify web player I can choose to block calls to recaptcha, facebook and similar with umatrix. Do you think that apps on average have less tracking or just that you tend to pay for apps but not for webapps and therefore get higher quality apps?

> data storage tied to the browser

Great! Data storage on the client should either be treated as unreliable or the only storage (for stuff where there is no "cloud" or privacy is critical). Tying storage to a single vendor (like icloud or google drive) is a very, very bad idea. Web browsers also have a well defined interface for you to inspect the data saved locally if you want.

> performance lower

For the majority of apps this does not matter. The reason webapps are usually slow is not that the platform is slow, it's that companies copy websites that are stuffed with tracking (if you block that they tend to be much quicker). They suck because the people who made them made them suck.

Most chat, mail, news, or any other form of text/image/video app could easily be performant enough as a webapp. Hell, amazon even made their real time game streaming service a webapp. The platform is not the problem.

> data consumption unpredictable

Not sure what is different here from native apps? Both can auto-update, both can download assets at-will, right?

> identification tied to web technologies

Yes please! That means it's portable and not tied into google/apple!

> Notorious for tracking abilities

A native app has every opportunity a webapp has to track you and much more.

> data storage tied to the browser

So? Browsers make it as easy to clear the storage of a webapp as it is to clear the storage of a native app. If you are talking about PC apps it is even easier to clear webapps' storage than native apps. If you mean it is bad because the stored data can disappear from the users device, that is what the localstorage API is for. Browsers will only delete that data if the user tells them to. This isn't any different from native apps having to deal with users deleting their files.

> Performance lower

While I have to admit that for raw computation webapps are slower than native, most apps don't need that much raw computational power and WASM should bridge the gap to native performance for apps that do need it. If your webapp is slow it is by far more likely you did a poor job programming it, not that you are limited by web performance.

> capabilities limited to browser api

Browser APIs are expanding all the time (except on iOS Safari but Apple has a vested interest in crippling webapps). And again, most apps don't need deep access to a system and the few that do shouldn't be webapps anyway.

> data consumption unpredictable

This has absolutely nothing to do with if an app is a webapp or native. Native apps can suck down data like crazy while webapps can use almost none and vice versa.

> identification tied to web technologies

Not really? Name one form of widely used identification that webapps don't support. You can use emails, usernames, 2FA, security fobs.

edit: remove snark at the end, it didn't add anything.

> A native app has every opportunity a webapp has to track you and much more.

Nope, an iOS app can’t leave a cookie that other apps can use to identify me.

Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.

The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.

> Nope, an iOS app can’t leave a cookie that other apps can use to identify me.

Maybe not directly, but by using something like the Facebook SDK the same effect can be achieved by shipping your advertising identifier off to Facebook who then does the tracking server side using events generated by the Facebook SDK. This is in tons of apps and you have no way of knowing it as an end user without reading the privacy policy or reverse engineering the app.

> Clearing storage is not the issue, making sure that the storage is not accidentally cleaned is.

This is just as much of an issue on native apps as it is with webapps, browsers wont clear local storage for a website unless the user requests it just like how a native apps storage won't be cleared unless a user requests it.

> The data consumption of an app is predictable because the download size would be listed in the appstore. On a website, it could be anything and the only way to find out is to load it. You can check out the data usage after install in iOS but there’s no easy way to do it for websites.

Just because the App Store download size is predictable doesn't mean the final download size is, lots of apps download a bunch of extra assets on first launch or even regularly as you are using them. I also couldn't find a way to check data usage of apps or websites on WiFi on my iPad so that isn't really a point either way.

A number of apps like the Chick-fil-A one explicitly advertise these as features:

> - Advanced Persistent Device Identification: Identifies individual mobile devices for both iOS and Android platforms, even if they have been reset or if the application has been reinstalled.

> - verifies the integrity of the application in which it is embedded to ensure it has not been modified or infected. It also analyzes all other apps installed on the device, and reports their reputation and the presence of any malicious code.

> It also analyzes all other apps installed on the device, and reports their reputation and the presence of any malicious code.

There is no iOS API that allows them to do this. Apple removed it years ago: https://appleinsider.com/articles/15/06/24/apple-expanding-u...

You are pretending that apps don't do any of that? The only difference is you have control over your browser(you can filter tracking sites etc) but for an app you have none.

They all have their strengths and weaknesses. I favor the Apps more that websites because of what the web has become.

Being able to know in what I am getting in and tapping install is much, much better experience than tapping on a link to the unknown then trying to figure out how to reach the thing I am looking for when the website tries to track me, monetize me, make me sign up all at the same time.

A website would usually load about the same size data of a native app without a warning and would report me to facebook, google and others.

That’s not something I am thrilled about.

> load about the same size data of a native app without a warning and would report me to facebook, google and others

Why do you think native apps are not like that?

Many apps load SDKs from google and (especially) facebook. They often load a lot of assets from servers.

I can see what is the required download size for install and I can track how much data an app is using on iOS.

For websites, this is not an option.

You can see the installed downloaded binary, sure. And you can see usage after the fact, but there is no reason to assume that the app store size is the only download it will use, most major apps I've seen use a lot more even when not downloading media.

It’s still much better than not having a clue.

So:

Option A: Only runs on one platform, can only be published on that platform with the blessing of the manufacturer of your device and little-to-no insight into data usage

Option B: Cross platform, can be interfaced with using open standards and block parts of it that you want (not just on a DNS level, but on a resource level)

I really don't see why you would prefer A?

You prefer option A because it’s much better experience.

If you’re building a service that’s not suitable for option A then you use option B. It’s not really a discussion at that point.

I’m glad that there’s an option B the way that I am glad that there’s frozen pizza in the fridge. Good to have it but I’m not gunning for it if a proper restaurant pizza is available.

> but for an app you have none

There are a number of pseudo vpn like apps that give you similarish control over native apps just the same as an extension on a web browser that uses hostname blocklists.

> Websites are simply apps installed in the browser without asking for permission.

I don't believe a website can upload your contact list, upload a list of apps on the device, log your GPS location or record using your camera or microphone. Is this no longer true?

> I don't believe a website can upload your contact list

Requires an opt-in permission on native, for browsers with support, it would also be an opt-in permission

> upload a list of apps on the device

Not possible on iOS for a native or web app. Depends on a number of factors on Android.

> log your GPS location or record using your camera or microphone.

Possible for native and web apps, but only after explicit opt-in permission.

End result, no meaningful difference between native and web for any of your examples.

> I don't believe a website can upload your contact list, upload a list of apps on the device,

True AFAIK.

> log your GPS location or record using your camera or microphone. Is this no longer true?

Depends on what you mean. This is fully possible on many phones and only needs approval from the user.

Then again approval from the user seems to be becoming the standard in installed apps as well.

That said, I much prefer web pages for things that need cloud or apps/desktop applications that works offline for the rest.

You can let the website do all these things however they would have to ask for an extra permission to access these API just like the native apps have to ask for extra permissions to access these API.

> I'm actually positive that I have a bank account that doesn't have a login info

I don't know where you are, but in the US it is actually illegal for a bank to offer financial services without collecting a significant amount of personal data from the customer. This exists for a few reasons but I think the most significant one is that the government does not want to give up the ability to block financial transactions for those they deem unacceptable. (Like terrorists.)

I don’t have login info but the bank definitely collected the necessary personal information.

It all makes sense, they are required to know me for AML reasons, so the account creation step collects this data.

The bank is mobile first, so the account is activated through the app when my card arrives. Why would I have a username and password for the app that is used to create the account in first place? The app can keep it for me without exposing it to me ever. I can’t be phished for something that I don’t know and it is one less password to remember or take care.

What's the process for if your phone dies or you lose it?

re—activation through scanning documents and taking a selfie. The process is initiated by entering your e-mail address.

Thanks for answering - not sure why someone would downvote someone directly answering a question!

I think it's the people that made reddit... reddit (and digg before that) slowly coming over here, moderation has kept them at bay mostly, but quality has definitely dropped in hacker news

https://news.ycombinator.com/newsguidelines.html

> Please don't post comments saying that HN is turning into Reddit. It's a semi-noob illusion, as old as the hills.

Which bank is this? Are there others in this space?

Not OP but I use Monzo and they have a very silmilar from to this. You have to enter an email address for account recovery and they send you a "magic link" that opens the app and logs you in, if you ever get logged out.

You then have to record a video selfie saying something like "I am NAME and I want to recover my account" and then send a pic of an ID. Same process (the selfie+ID part) for if you want to display your card PIN reminder.

The nice thing about this flow is that I only need what I already have: my face and my ID. Even my (elderly) parents can manage this process when needed.

I am sure that his bank did collect a lot of information upon account creation; that has nothing to do with their app login process though. Every bank adheres to 'Know Your Customer'.

The most significant reason is preventing your identity from being stolen.

No it's not. "Know your customer".

> they are only good to sync between devices

As an occasional discord user: yes, exactly. That's how Discord syncs communities and read messages between my phone, tablet, and computer, either via app or web client.

This is a huge convenience over say IRC where (last time I looked) the way to get any client-side consistency is to run a personal 24/7 relay on your own server and use special clients to connect to that instead of the main IRC server.

Which is the setup equivalent of not wanting a Dropbox account because "you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem."

>I don't understand why people even ask for account creation. Now days the devices are personal, you don't have to have accounts to be identified.

Why would I want every single thing I do online to be directly linked to one physical real world device?

It's not so much about data loss for me but I don't want anything real world linked to me to be used to authenticate me in any way other than monetary transactions or things with tangible physical value.

Other than that, I have a range of email addresses and usernames I use depending on the nature of the site and the amount of personal information i'm willing to disclose.

I have a fairly fine grained system for managing my user accounts accross various platforms and i'm personally finding it more and more aggravating the amount of places that require some kind of google or facebook sign in, let alone the idea that my phone should be my universal user account/name.

The internet should be like the rest of public life. For the most part, in my day to day life, I get to choose the amount of personally identifiable information I disclose to others. Managing multiple user accounts with differing levels of personal information is the internet equivalent of this.

I do not wish to be linked to one 'universal digital me' my real life interactions are not like that, why should my internet interactions be forced to be that way?

I have different groups of friends, acquaintances, coworkers etc. I don't act the same way with all of them, I don't talk about the same things with all of them, they don't all have the same level of information about my life, yet increasingly, online interactions are being pushed into this 'one you for everyone and everything' paradigm that is completely antithetical to the original values of the early internet and human interaction in general.

The assumptions you usually have to make with that approach is:

- The app is used on one device

- Only one user has access to a device

- There is a convenient or reliable way to identify a device for all platforms you target

Plenty of apps can live with those, and plenty can't. email address is one of the least bad ways to do it.

To be fair, I think there are some smart app developers clueing on this. I've sank pretty significant hours into some mobile games without ever creating a proper account. I only created an account once I cared enough to not lose the data. This is super smooth mobile UX especially for consumer facing apps, primarily those which have no immediate need at all to be cross platform.

Duolingo is one that stands out for this.

Cargo cult is an early stage of development, this is evolved to the point of having a logic of its own.

It might just be a matter of boilerplate. The permissions and usernames are (in code, in legalese, etc) may be tied to the concept of a signup. They might have investors, advisors or whatnot asking about weekly registration trends or somesuch. They may have a regulator, and the regulator assumes that you have info.

Even banks are increasingly getting regulator-ish. You may need to produce a "know-your-customer" policy.

Anonymity just isn't done anymore.

>Anonymity just isn't done anymore.

Passive voice alert! By whom? Site/app producers can, with certain exceptions, choose to allow anonymity.

I believe their point is that site/app producers are increasingly pressure not to allow anonymity by investors.

Site/app producers with investors, and really, investors of a certain breed. Investors that "encourage" certain business models that depend on prohibiting anonymity.

investors, banks, regulators, other companies that are regulated....

> Even banks are increasingly getting regulator-ish. You may need to produce a "know-your-customer" policy.

That's an understatement, if I ever saw one.

> Anonymity just isn't done anymore.

When was banking anonymous? In the days of Bonnie and Clyde? :-)

I mean operating anonymously at all, not banking anonymously.

If you want to not be an insanely easy target for DDOS attacks, requiring customer signup is pretty useful... not sure why this is not being mentioned.

Well because many services aren't just a mobile apps, and people use multiple devices, and devices have to be replaced from time to time, there are a lot of legit reasons for accounts. There are a lot of ways to mitigate having to make accounts, but many are less secure, more work, and most users at this point are use to creating an account.

Accounts don’t have to be explicit. Ask only for the info that is necessary to provide your service and store it in auto generated account and provide a way to tie this account to some other account like e-mail or phone number for account restoration purposes.

I mean that sounds like a normal account registration process for most things that exist?

what more are you typically putting in, other than an email address, maybe a username for uniqueness, etc...?

The main difference is that the user can start using the service right away and can secure the account some time later.

You can use firebase accounts to manage that. Start with the anonymous account which will create an account with a random UID and use the mechanism to convert the accounts into “registered”. Pretty easy, you don’t even have to create your own custom solution.

Lots of mobile games do this, you get a device tied account and then after you've played a bit they ask if you want to link to a real account to avoid losing progress.

How can you prevent Sybil attacks?

You can check for real device. You can have rate limiters. You can request e-mail/phone validation before providing a valuable service. I guess depends on the nature of the situation.

Apple Anonymous Attestation is the only thing I know about and it is just now available. And still rich people can afford toms of apple devices but at least it has a large cost.

Reply on news.ycombinator.com