Hacker News new | ask | show | jobs
by ChrisMarshallNY 806 days ago
It's quite possible to develop products that afford security. I'm pretty sure that I know why it doesn't happen, but I won't get into it.

In the app I just released, we take security very seriously. I have spent days on just the login screen, tuning it, so that it lubricates the sign on experience.

In fact, that's what I'm doing, right now. Some of our users have been getting confused with Sign In With Apple, so I'm looking at ways to make it even smoother.
2 comments
buttcomputing 806 days ago
At some point, "not taking security seriously" is simply negligence. Other fields already have ways of punishing people for negligence (up to and including suspension of licensure and/or prosecution). Why are software developers immune to consequences for not realizing they need to use parameter binding in their SQL statements?
link
mewpmewp2 806 days ago
Is that security or just UX thing?
link
ChrisMarshallNY 806 days ago
> just UX thing?

To engineers, especially ones that use CLIs a lot, "UI" is simply "silly chrome for lusers."

However, the other 90% of users think that it is very important.

I have been looking at the signups for a while, and wondering why the SiA signups have been going unused (or the person tries again, with a non-SiA signup).

It was because of a "UX thing."

It's really, really important to take the "UX thing" seriously. It can make or break products. The OXO line of kitchen gadgets got huge, because the designer's wife was disabled, and he designed tools to make her life easier, which also made everyone else's life easier.

link
mewpmewp2 806 days ago
What was the thing they got confused about and what is the fix?

It's just that it only makes sense to me as a security thing if Sign in with Apple is specifically more secure than other methods of sign in.

I usually like 3rd party logins, don't need passwords, but there's potential for them to be multi-edged sword. Depending on the implementation.

link
ChrisMarshallNY 806 days ago
SiA is quite secure, but on my end, it could be quite insecure. It's basically an SSO-type thing.

The workflow is a bit different from the standard login ID/password entry. You use a "Sign In With Apple" button that the OS provides, and that has its own on-device (and cloud) credential generation.

I was not optimizing for the button. There's no need for a user ID, if you are using SiA, so I should not have presented that field to users. Also, some credentials are only available at generation time, and have to be maintained by the app (securely, in the keychain).

That behavior can get reflected in the UI, and may be confusing to folks.

SiA is the only SSO solution we use. I won't use anyone else's code for that stuff, and we keep all user data inside the app. We also don't collect very much.

link