[HN Gopher] Ask HN: Lightweight Authentication
       ___________________________________________________________________
        
       Ask HN: Lightweight Authentication
        
       I want to let users log in to my proof-of-concept Web app. However,
       I don't want to maintain a fully-fledged authentication solution,
       managing logins, passwords, OAuth tokens, and their recovery.
       Ideally, I'd like to receive a unique user token and allow one to
       log in back if they decide to return. I don't need any user
       metadata.  OpenID requires quite an effort and a provider like
       Google or Okta. The most-matching concept was Mozilla Persona, but
       it was shut down in 2016.  What is the better way to implement
       this? Should I stick to the plain old login-password combination?
        
       Author : scoresmoke
       Score  : 8 points
       Date   : 2022-12-29 20:03 UTC (2 hours ago)
        
       | jonahbenton wrote:
       | An excellent women's soccer publication, Equalizer Soccer [1],
       | which seems to use Memberful, has the authentication system I
       | want EVERY non-critical publisher/app to use-
       | 
       | 1. enter email address
       | 
       | 2. email me a signin link
       | 
       | 3. i click the link
       | 
       | 4. i am in, on whatever device i am using
       | 
       | There is no password and no needed coordination with my password
       | management.
       | 
       | It is glorious.
       | 
       | 1. https://equalizersoccer.com/
        
         | rsj_hn wrote:
         | Substack also supports email sign-in,
         | 
         | https://substack.com/sign-in?redirect=%2F
         | 
         | ..but they have the option of a password sign in as well. It's
         | really a good idea.
        
         | giaour wrote:
         | Popeyes.com does the same. Is really convenient, and I
         | appreciate not having to trust a chicken chain with anything
         | more sensitive than my email address.
        
       | blondin wrote:
       | send an expiring unique nonce token to their email address. when
       | testing period is over you could implement another solution.
        
       | 0xPIT wrote:
       | https://github.com/ory
       | 
       | You should also be able to get a free tier at Auth0
        
       | throwaway888abc wrote:
       | For PoC Firebase Authentication
       | 
       | https://firebase.google.com/docs/auth
       | 
       | You get hosted + UI + OAuth
       | 
       | There are many others:
       | 
       | https://supabase.com/docs/guides/auth/overview
       | 
       | https://www.keycloak.org/
       | 
       | https://www.permify.co/
       | 
       | ...
       | 
       | ..
        
       | toomuchtodo wrote:
       | https://passkeys.dev/
        
       ___________________________________________________________________
       (page generated 2022-12-29 23:02 UTC)