WeChat ID
aaronpk_tv
-
We've confirmed the venue! IndieWeb Summit 2017 will be at ...🥁... Mozilla Portland! 🦊🎉 https://2017.indieweb.org -
Reminder: Homebrew Website Club PDX tonight at @DreamHost! 🍕🍻🌎🎉 Hope to see you there! https://indieweb.org/events/2017-05-10-homebrew-website-club -
Amr Eldib
https://www.amreldib.com
•
May 10
I had to change the timezone myself using the web site. It's somewhere in the General settings. Maybe you have a different model.
@amreldib yeah I'm skeptical it's going to automatically figure out my sleep patterns while traveling, despite the app knowing my location -
So far @FitBit has been doing a surprisingly good job of tracking my sleep. Tomorrow, we'll find out how well it handles timezone changes.
-
Bret Comnes
https://bret.io
•
May 9
Sorry I'm out of the loop. Websub is the next version of pubsubhubbub?
@uhhyeahbret Yeah! It's functionally the same, clearing up some ambiguities and improving the language. Hopefully see you tonight at HWC? -
Just finished the @W3C #WebSub test suite! Try subscribing to the test feeds at https://websub.rocks and submit an implementation report!
-
Portland, Oregon • Tue, May 9, 2017 6:24pmNET BEECN training
-
@Gargron Any chance you're able to make it to IndieWebCamp Düsseldorf or Nürnberg? We'd love to have you there! https://indiewebweek.indieweb.org/
-
Portland, Oregon • Sat, May 6, 2017 5:59pm -
Portland, Oregon • Sat, May 6, 2017 4:16pm
-
Portland, Oregon • Fri, May 5, 2017 5:52pmStreamPDX Open House!
-
Patrick Schaller
http://F3Development.com
•
May 4
Yeah... Does that mean there are alternatives to SFSafariView if you own the app and API?
@rogue__leader so some services use the password grant to exchange a un+pw for a token, and build the login interface natively. -
Patrick Schaller
http://F3Development.com
•
May 4
Yeah... Does that mean there are alternatives to SFSafariView if you own the app and API?
@rogue__leader Well for first-party apps there isn't really a phishing risk, it's normal to type your password into the service's own app.
-
Patrick Schaller
http://F3Development.com
•
May 4
Awesome, I’ll check those out. Business doesn’t understand why I can’t do this in a way that doesn’t show URL. Since it’s our app and API.
@rogue__leader Yeah the Google case is interesting since they're doing it with their own apps!
-
Patrick Schaller
http://F3Development.com
•
May 4
WOW, thank you so much! Do you know, offhand, of any mobile apps doing Auth this way?
@rogue__leader The Google Inbox and Voice apps do it! I know I've used a couple more, but can't remember off-hand.
-
Patrick Schaller
http://F3Development.com
•
May 4
Sorry, I meant I'm being told the URL can't be visible and they are holding up other mobile apps login as examples that do not show it.
@rogue__leader Yeah sorry, 140 chars isn't enough 😭
Before SFSafariView, the only way to securely do OAuth was to launch the native Safari browser. This meant you'd get bounced out of the app, which a lot of developers didn't want to do to their users. I don't disagree that this was a bad experience, and plenty of people feel the same.
What ended up happening is people instead started embedding the WebView into their apps, in order to avoid having their users bounce out of the app and come back. The compromise in this case is that people would have to type their password to log in, because the embedded WebView doesn't share cookies with the system browser.
It took Apple a long time to roll out SFSafariView, so there are just a lot of apps out there that still have the embedded WebView.
Advantages of WebView:
• Does not make the user leave the app to complete the OAuth flow
Problems with WebView:
• User has no way to verify they are on the real website, so phishing attacks are undetectable
• Does not share system cookies, so users have to type their password every time
Advantages of SFSafariView:
• Does not make the user leave the app to complete the OAuth flow
• The user can see the address bar so can verify they're on the correct website
• Shares system cookies, so the user won't have to type their password if they've already signed in using the native Safari app
I should probably turn this into a proper blog post.
