WeChat ID
aaronpk_tv
-
Jeffrey Yasskin
https://twitter.com/jyasskin
•
Apr 10
And we're about to have to integrate login into browsers to make anti-tracking efforts like ITP actually work. I don't know exactly what that'll look like (or what URL to point you to yet...) but please keep your eyes open and help make sure we don't screw it up.
I'll definitely keep my eye out for this! It'd be great if you could post something to the OAuth or OIDC mailing lists when you have a proposal too. https://oauth.net/about/community/ -
apenwarr
https://twitter.com/apenwarr
•
Apr 10
That creates a chicken-and-egg problem: browsers won't adopt it unless it's popular. It won't be popular unless browsers adopt it.
Chicken-and-egg problems create usually-insurmountable barriers to adoption.
That hasn't been true for years. Browser vendors are pushing new features that they want or think will be helpful. Here are some examples: https://github.com/WebKit/explainers
See also all the Twitter threads of people getting angry that Chrome implements something before it's standardized. -
apenwarr
https://twitter.com/apenwarr
•
Apr 10
If login were automated like credit card forms, it would fail about 50% of the time and need me to enter a page full of unnecessary personal information by hand. That’s not a good model.
Why not let me enter an email address instead? That has a domain in it.
Why is entering an email address less work than entering a URL? What I'm saying is browsers could have an "account chooser" UI to save a URL and enter it in the login field. -
apenwarr
https://twitter.com/apenwarr
•
Apr 10
Neat! Seems to still have the URL pasting problem though. How is that UX different from openid, which users didn’t like?
That problem can only be solved by browsers.
Right now, most of the time the browser autocompletes my URL because I've entered it enough, so I'm not actually typing it out. With any amount of thought, browsers could automate that just like credit card payment forms. -
Dmitri Shuralyov
https://twitter.com/dmitshur
•
Apr 10
Have you considered using IndieAuth (https://indieauth.spec.indieweb.org) which does the same now?
I’ve implemented it on my personal site (https://github.com/shurcooL/home/issues/34) and I’m very happy with it. Especially during GitHub outages.
Here's some background on why this solves the particular problem you're talking about in this thread: https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web -
Are you missing out? Happy Hour is half over… but it's not too late to join. Jump in, the water's lovely! (so's the booze) https://jal.bz/2ynx6oi
-
My #OktaneLive talk is up! "What's New with OAuth?"
In just 30 minutes I cover the latest developments in the OAuth working group! So much new stuff happening in the OAuth world right now!
https://youtu.be/g_aVPdwBTfw -
Hard to believe it's already been a month since I posted this video.
I've already done over a dozen virtual conference talks and remote workshops with this setup now!
https://www.youtube.com/watch?v=yNzU-TPdxR4
