Hacker News Reader

Comment by arkokoley | Hacker News Reader

It started out as a clone of http://nightchamber.com. That functionaluty was simple to emulate. Now I am trying to build a complete loginless social network. Although, the logging in process is highly device dependent, it will involve making the user approve the devices he intends to use the network from. What's fun is the number of ways I had to come up with that will make sure that the correct user is logged in regardless of the device he accesses it from.

Its on github: http://github.com/arkokoley/nightowl

View on HN

Seems you're building an authentication mechanism which is based on private links. You should keep in mind that with services like similarweb.com, which steal users click-stream using a number of extensions that sell them this data, the concept of private links no longer esxists. Open a link in your browser, an extension sends it to similarweb.com, and the "private" url will be displayed on their dashboard, to their premium users.

The authentication mechanism actually uses cookies, that don't expire for a long time, to authenticate the user. Private links come in when the user wants to log in via a device which he does not usually use.

Interesting... Care to explain the concepts behind your loginless auth? In a sentence or two? Thanks! (do not have time to go through code myself :( )

Whenever a user visits the website, a session cookie is created in the user's system, that is set to expire after 15 years. Using this cookie data, I identify and authenticate the user.

The user also has a private url which he can use to login using other devices. Once logged in from this unidentified device, another cookie is created for the user but with a short time span. The user has the option to set the device as trusted which will result in the cookie expiry to be set at 15 years.

OK, got it.

You probably ask for user's email and send them their secret special link that could be used over and over to restore the cookie? in case if they accidently delete their cookie?

Not yet. Currently the user has to make sure to save that link. There is no recovery if they delete the cookie and have no access to the secret link. This idea originated from NightChamber which refrains from asking for any kind of user details to maintain anonymity. But that might have to change with my implementation because of the social network like features. Emailing the secret link seems good, now that I think about it. Thanks!

Reply on news.ycombinator.com