Hacker News Reader

Comment by antimatter15 | Hacker News Reader

Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email.

Also, for something like that you should use <img> instead so it's less of an XSS risk.

View on HN

> Except something like this would be easily spoofable, ie. you could set your hosts file to make all a.example.com links return HTTP 200's, or open firebug to call user_is_logged_in() and you could reset passwords without any email.

Yes. But depending on how gmail works it could me made reliable and secure. For instance if you can share images with gmail users you could generate a unique image for that user, do the same thing with an <img> tag, access the image data with JavaScript, send it back to the server and compare if the contents are the one you shared.

I do not have a gmail account so I don't know if this is possible, it it seems like it would be possible for Google+ from briefly looking at it.

But with all that, you would need cooperation by both Google and Facebook for the feature and it would be just as complex as simply using OAuth.

It would work on any service that allows you to share an image with one individual user.

The service would need to send out the Cross Origin Resource Sharing headers in order for the image to be accessible via <canvas> and the service also needs a means for the querying server to test if a certain image is indeed the one associated with the user.

And if it was an image generated by Facebook, then Facebook must have access to the account beforehand, and there's no benefit to using this system over OAuth.

> The service would need to send out the Cross Origin Resource Sharing headers in order for the image to be accessible via <canvas> and the service also needs a means for the querying server to test if a certain image is indeed the one associated with the user.

// EDIT: ignore what was here, you're right.

tried email?

I deleted my other question about how FB can know that the image is not a fake. My finger hit the wrong button ;) I'll answer here. Your idea can be done, but I don't see the advantage it would have over other methods.

Reply on news.ycombinator.com