Login with HN
Security and privacy
authentication
SHOW HN2022
436points
149comments
#75of 2,570 in 2022
Top 3%of 2022 by points
How HN took it
CuriousMostly questions and neutral comments
15 positive, 33 neutral or asking, 1 mixed, 12 critical, out of 61 comments about the project. Thread score +0.11.
Idea: 8 for, 1 againstPerformance: 1 for, 4 againstPrivacy: 1 for, 4 againstDesign: 3 for, 1 againstExecution: 0 for, 2 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Smart, low-impact token-in-profile approach that avoids passwords
From 3 comments
This is a smart implementation. I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives…
simonw on HNWow, awesome! We've had a few startups ask for an HN integration at https://clerk.dev and we'll build this in ASAP. It would be great if this could somehow verify whether an HN…
colinclerk on HNThis is a smart, safe implementation. On a side note: I wish HN offered 2FA.
clay-dreidels on HN
Useful idea with precedent in Keybase and other sites
From 3 comments
Agreed, and it doesn't really matter but for some reason I felt compelled to mention, this same mechanism (putting token in profile page) has been in widespread usage for years…
freedomben on HNThis is kind of reminiscent of how keybase verifies your ownership of social media accounts, domain names etc.
hnarn on HNHi, I just wanted to say I have fond memories of using garrysmod.org to download add-ons for gmod back in 2008-2010 or so. They used the same authentication technique by giving…
voussoir on HN
Objections
Load and HTTP 500 errors made login unreliable at launch
From 3 comments
It didn't appear to be working after a couple of attempts. Opening the console shows a lot of HTTP 500 responses coming from /api/v1/hn/poll/status
Minor49er on HNGreat idea, I like the concept of using a code in your bio as the auth mechanism. As another poster replied, the api seems to be 500'ing
laputan_machine on HNThe API is responding that the request completed successfully, but it doesn't appear to authenticate. I even tried replacing my entire About section so that it was only the code…
Minor49er on HN
Login code is not explicit enough and could enable phishing
From 2 comments
>How does it work? >[...] >LoginWithHN generates a unique one-time-use code that the user must then put into their profile within 5 minutes I like the implementation, but…
gruez on HNYou're right -- I will make this more explicit to hopefully prevent some phishing attempts
hardwaresofton on HN
Themed like HN, which feels close to phishing
From 2 comments
I think it’s in poor taste to theme your site to look like HN. Feels a little close to phishing.
schwede on HNQuestion - are you affiliated with HN/YC at all? If not, I would be concerned about the colors/branding on the homepage being the same as HN/YC. I see the word “unofficially”,…
tomhallett on HN
Lacks audience binding in OAuth, so tokens could be replayed
From 2 comments
it seems like if this is OAuth2, the protocol is not giving an audience specifier? That would mean that any token is as good as any other, and say, authenticating to…
zemnmez on HNAh yes, this is something I'm going to tighten up once we have OAuth2 clients signed up -- right now the only client is the actual loginwithhn site itself!
hardwaresofton on HN
Requests
Add a confirm button instead of polling profile
From 1 comment
This is a smart implementation. I was worried it would be doing something uncouth like asking for your HN password or scraping some kind of unofficial API, but instead it gives…
simonw on HN
Minimum karma or account age requirement
From 2 comments
Congrats on putting this together, it looks really cool. One suggested feature that crossed my mind is to allow a minimum karma or account tenure requirement, in order to screen…
version_five on HNThat's a fantastic idea, thank you, I'll implement that.
hardwaresofton on HN
Verify YC cohort membership
From 1 comment
Wow, awesome! We've had a few startups ask for an HN integration at https://clerk.dev and we'll build this in ASAP. It would be great if this could somehow verify whether an HN…
colinclerk on HN
Native 2FA on Hacker News
From 2 comments
This is very clever. On a side note, I wish HN offered two-factor authentication.
clay-dreidels on HNThis is a smart, safe implementation. On a side note: I wish HN offered 2FA.
clay-dreidels on HN
Questions
How is the code protected from third parties scanning profiles
From 1 comment
This is neat. How do you protect against a third party scanning HN profiles for codes and stealing them?
paxys on HN
How to avoid caching of the profile page
From 2 comments
Very cool, I was experimenting with a similar implementation of this a few years back. We were using a browser extension to handle the posting to the profile for you. However, we…
todd3834 on HNI'm doing something very similar with my service: https://aytwit.com/thoughter To the author, there is a simple trick you can pull in order to make the confirmation instantaneous…
dougk16 on HN
Alternatives named
Keybase identity verification
From 2 comments
>How does it work? >[...] >LoginWithHN generates a unique one-time-use code that the user must then put into their profile within 5 minutes I like the implementation, but…
gruez on HNThis is kind of reminiscent of how keybase verifies your ownership of social media accounts, domain names etc.
hnarn on HN
Public key in bio with message signing
From 2 comments
Great idea. If you need to add a code to your bio, another idea is putting a public key in your HN bio and signing a nonce message using some browser extension like Metamask.
udbhavs on HNImplementation idea: this method reminds me that we can post our public keys in bio, which means logging in could just mean signing a message that says "sign me in to %service%"…
ulucs on HN
Garrysmod.org Steam profile token
From 1 comment
Hi, I just wanted to say I have fond memories of using garrysmod.org to download add-ons for gmod back in 2008-2010 or so. They used the same authentication technique by giving…
voussoir on HN