Hacker News Reader

Comment by simonw | Hacker News Reader

This is a smart implementation. I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives you a token to embed in your public profile - so it's still scraping your profile page, but that feels like a very low-impact way of building this.

Suggestion: on the "Put the token below in your HackerNews Profile" page, rather than polling to see if the token has been added (which is a bit rude) add a button for "I have added this token to my profile" and only check once the user clicks that button.

View on HN

I totally agree with you and I was also worried about uncouth behavior. That said, and not to undercut the smartness here, I have memories of this being the main mechanism to authenticate third party services to the SomethingAwful forums.

I have vague memories of thinking through how scraping could be used for much easier global authentication and then quickly how that was probably a dumb idea.

Yep, I still do this with gbs.fm!

What is gbs.fm if you dont mind me asking?

Some quick Googling yielded: https://forums.somethingawful.com/showthread.php?threadid=38...

A community radio station where you have to be a somethingawful member to access.

Have you considered playing more Journey? :^)

this site is the last place i thought i'd find a gbs.fm reference

Had to migrate somewhere!

Ah the memories and nostalgia of seeing this comment are immense! I miss the good ol' days of the pre tech giant internet. I used to go to the in person NYC charity events and it was an awesome community.

:wave: other goon, hope you and all are well.

Instead, the token (a text string) will be an "object" (a non fungible token) that you prove is in your wallet with zk proofs,

wallet being on whatever chain(s) decided upon as ubiquitous in the coming year.

I assume this is /s and I laughed when I read it. Well played.

It’s not sarcasm, and it is what some communities want to achieve with decentralized identification.

https://www.microsoft.com/en-us/security/business/identity-a...

Reminds me of how I got users to verify their ownership of Minecraft accounts[0]. There is no profile to add a token, but they can switch their skin, and you can download a user’s skin without being in-world.

[0] http://zacstewart.com/2012/12/24/verifying-minecraft-user-ac...

Cool write-up! Wouldn't you need to generate a new random verification skin for everyone that tries to verify?

This is long dead, but yes that would be the next step. At least right now, you could only falsely claim someone’s account if they installed my verification skin, but you could wait for someone to do that and then quickly claim their account before they did.

"... I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives you a token to embed in your public profile ..."

I have a side project I've been kicking around for a while that required some kind of reputation/login/accountability function and this was exactly what I considered doing: giving people a token to put into a public HN profile.

So anyway, great job Victor!

Hey if you don't mind I'd love to have you kick the tires -- there aren't any client apps (other than the website itself) right now, but I'll be opening that up soon, got some bits to batten down like audience and registration forms.

So, so pessimistic that I can carve enough time away from rsync.net to start this new initiative ... but we'll see ...

rsync.net is a massively awesome product, I think I can safely say the rest of the internet is hoping you don't get any time away :).

The tyranny of success.

> doing something uncouth like asking for your HN password

Yeah I was worried about this too, it's a disturbing trend.

Venmo was asking for my bank password a couple months ago, I was like fuck no. Who the HELL does that. Should be illegal to even ask.

In the case of venmo (and many other of their customers), it was actually Plaid that was asking for your bank login credentials to connect your bank account to Venmo. They've been getting criticism regularly for that, unsurprisingly.

(And Plaid noted that they vastly prefer to oauth to banks, and do with many other banks, but that Venmo won’t accept oauth and demands credentials.)

No that’s not correct. Venmo is not forcing password auth, it’s banks not implementing the OAuth flow that causes this. I just went through with OAuth in Venmo with my bank (Capital One). They also offer traditional (deposit 50 cents and validate the amount) work flow too, they’re not forcing the Plaid model at all.

Erm, I don’t think we’re describing the same sides of the flow, but I trust you’re right anyways. Apologies for my confusion.

Yeah so now I need to give my password to not just Venmo but also some startup called Plaid that I need to trust?

Doubly fuck no.

To clarify -- Venmo doesn't get the credentials at all, only Plaid does. Venmo then uses an API to get the specific bank account data it needs from Plaid.

I still don't trust Plaid.

Venmo could also get the credentials if they want to, since they're launching it from within their own app. They could keylog everything in their app if they wanted to, including what happens inside Plaid.

Nobody should ask for passwords to anything but their own service. Period.

Asking for bank passwords should be made illegal. If I were the president I would have made that a federal law yesterday.

The president doesn't make legislation.

Plaid provides a useful service that's a stop gap for the poor infrastructure of banks. I honestly doubt that most banks would have even bothered to start the laborious process of OAuth without them being an extremely popular middle layer for services like YNAB. My company actually uses them to process recurring payments.

Yeah well I would have also made it a law for banks to support OAuth and hardware key 2FA, hand out 2 Yubikeys to every citizen and ban SMS, among other things.

Plaid is not useful if they need to ask for passwords.

Plaid is not some tiny startup... They're almost 10 years old and Visa tried to buy them for $5B a couple years ago.

That doesn't mean you should trust them (I don't), but just because you haven't heard of them doesn't mean they're not big.

Venmo offers the traditional verify a deposit amount validation method too, it just takes a few days. It’s an either or method.

I complained about that Venmo thing on Twitter and got an interesting conversation going about it, including with comments from the CTO of Plaid who are the company who built that integration.

https://twitter.com/simonw/status/1479174549266526209

Short version: OAuth for banks is finally starting to happen, but in the meantime the password anti-pattern fills the gap.

This recently started happening with Paypal. Bank payments were my default, and recently when I tried to buy something paypal started demanding my bank login. Nope. Not now. Never. You do not need to know my balance and all my transactions for a $100 purchase, Paypal.

For all the obscure examples of prior art being given in this thread, this is also how Keybase did proofs with HN.

the exact user flow for a third party Auth system in Observablehq

https://observablehq.com/@endpointservices/login-with-commen...

all code is ISC licensed and both the server and client is embedded in a web notebook

This is very clever. On a side note, I wish HN offered two-factor authentication.

+1, would be nice to have 2FA

Just pick a good password and don’t reuse it elsewhere. HN is super aggressive about rate limiting attempts, so brute force isn’t really a risk.

2FA also protects me in case someone runs https://github.com/unode/firefox_decrypt on my computer, maybe as part of an NPM install script

Do you not stay logged in to HN?

Never! I log out EVERY... nah, you got me haha. I honestly wouldn't even care if someone stole this account. Just having fun nitpicking :)

Phishing is still an issue that could be prevented with security keys. That said, I don't see most HN accounts being very interesting to phishers.

What about a cryptographic signature? That might be nice.

Agreed, and it doesn't really matter but for some reason I felt compelled to mention, this same mechanism (putting token in profile page) has been in widespread usage for years so isn't novel. Keybase is one example.

Even before that, this is a common practice with DNS for decades to prove ownership of a domain.

SPF

DKIM

Let's Encrypt Certificates

Reply on news.ycombinator.com