jonalexr

Hm, the landing page states "No signup, no registration." yet the popup once clicking "Create a Room Now" prompts you with "Sign up to know when we launch:"

Might be better to revise the copy to reflect it.

Hm, looks like the example pages are missing validation for user input.

If you're on a Mac check out https://github.com/liquidx/webviewscreensaver - Works well but you might not always have an internet connection so I just saved the HTML/CSS/JS into a folder and linked directly to that (and it works!)

Thanks for the feedback! You brought up a valid point. It's something that will become more of an issue as the website increases it's user base and we'll think of ways to address it.

Hm, that's a good point. I've found that most people have a text message plan which allows for unlimited incoming text messages but we'll take that into account and make it clear to the user.

It's great to get different perspectives on the concept. I agree that enforcing rules and resets does impact user experience.

What if the user was to authenticate once via SMS (we send them a code and they enter it within a reasonable time period), and once they do, they're authenticated for an infinite amount of time. This way they don't need to remember a passcode, and just need to have their phone on them when accessing the website from a new computer - a similar experience to two factor auth.

Yeah that's true, thinking about it further a way to solve this could be allowing infinite sessions with the initial passcode being sent to you via SMS.

This way you wouldn't need to remember a different passcode each month and the login attempt issue wouldn't exist because passcodes are generated when you need to login.

Agreed, I'm just toying with the idea of finding the simplest way for a user to access a website securely. Haha, that's why I posted here before implementing it ;)

We'll be focusing on mobile, and the login process could be something like PayPal's mobile app where they let you login with your phone number and PIN (min 4 digits). I'm just looking for a secure way to translate that to a web app.

Something that could help - sessions could persist for an infinite amount of time, so upon first login we send them 4 random digits via SMS and if they enter it correctly they're authenticated. Basically two factor auth without the initial password.

Regarding website authentication, I've been looking for some feedback on a new auth scheme.

Instead of using a standard password (all characters are allowed, min 5 characters, common passwords not allowed), you're able to login with a 4 digit passcode. I know someone just cringed at that thought, but the idea centralizes around improving user experience on the website.

First, all normal precautions would be taken (no common digit patterns - 1234, 1111, 2222, etc). There would also be a limit of two attempts before the passcode is reset. The reset procedure would be them receiving a new passcode via SMS, and them having to reply "yes" before the account is unblocked. The passcode is also reset every month, and a new one is sent via SMS to your phone (you can reply to change the passcode to something else).

Now for the issues I would need to address before this is even a possibility:

1) Users on the website login with their phone number, so one obvious attack would be someone cycling through all possible phone numbers with the same passcode (for example 8237). One suggestion in the article was detecting average error rates and comparing them to see if the entire website login should be throttled.

2) If someone somehow gets a hold of the database, all passcodes would be easily crackable. Now usually this would be a huge issue, but this is because normally people could use the email/password combination to login to other websites the user might use. Since they're using 4 digit passcodes, this wouldn't apply.

3) Someone could write a script to try phone number/passcode combinations until the entire website has their passcode reset, but this would fall under 1) where the error rates would exceed the normal limits and the logins would be throttled.

4) What would be an appropriate way to throttle? I mentioned it twice above, and in the article it was referring to a timeout, but the user experience of this would negate all benefits of a 4 digit passcode. Someone could keep trying combinations, and keep throttling the site every day. I could block the ip's, but what if those ip's were also sources of legitimate traffic and stopping users from logging in/signing up.

Thoughts?

The one labeled "Web App Template" is a working HTML/CSS/JS website and we'll be releasing HTML/CSS versions of all the PSDs soon. Send an email over to hello@knok.me and we'll let you know once they're out!

I was thinking about this a couple of days ago - with Like buttons appearing all over the internet, Facebook has the ability to log what sites you visit, when you visit them, etc. Question is, do they? To what extent?