We need domain ownership proof based authentication (tautvilas.dpage.io)

4 points by brisky 6y ago ↗ HN

5 comments

[ 4.5 ms ] story [ 20.2 ms ] thread

There is IndieAuth, which adapts OAuth 2 to work with URLs as identities (and being OAuth, can even do authorization): https://aaronparecki.com/2018/07/07/7/oauth-for-the-open-web

https://indieauth.net/

brisky 6y ago ↗

The problem with OAuth - it is too complicated. Both for developers and for users.

detaro 6y ago ↗

OAuth 1 I'd agree with that statement (it's use of crypto gave it more pitfalls), but basic OAuth 2 is really not that bad. It's a few fairly straight-forward HTTP requests.

rasengan 6y ago ↗

DNS.live does this for its free web and DNS hosting [1]. All you need to do is sign any post/api call with the private key associated with the address in control of your handshake tld.

An example is on github [2][3].

[1] https://dns.live/hosting.html

[2] Server: https://github.com/dnslive/dnslive-webserv

[3] Client: https://github.com/dnslive/dnslive-webhost

brisky 6y ago ↗

That is a cool concept. I wish more web platforms would offer similar options.