5 years ago Anush

Hi,

  1. When you join it gives you a long key and says you should record it. But it isn’t copyable so there is no way to do that! This seems true at least in Chromium in Linux.

  2. It would be really helpful if https://topanswers.xyz/codegolf had a way to list all the currently defined tags.

  3. I couldn’t see a way to sort the questions by how popular they are or any other criteria.

  4. If you click on a tag it would be great if it listed only questions with that tag.

Top Answer
5 years ago Jack Douglas

These are good suggestions and we are thinking of ways of implementing them all, thanks you.

  1. When you join it gives you a long key and says you should record it. But it isn’t copyable so there is no way to do that! This seems true at least in Chromium in Linux.

Originally, the sign-up process was simpler, and the pop-up dialogs were added later for compliance, and to encourage people to save their login key.

More recently, system notifications were added, and we started generating a notification with link to the profile page and prompt to save the login key on sign-up.

We think that is enough on it’s own — the benefits of more nagging (if there even are any benefits) are outweighed by the downside of tainting one our unique features: low friction sign-up. We know from feedback that is a welcome change from most other websites (though it is disconcerting from some who are used to having to hand over PII everywhere).

  1. It would be really helpful if https://topanswers.xyz/codegolf had a way to list all the currently defined tags.

You can now visit https://topanswers.xyz/tags?community=codegolf (or click on any tag) to get a rudimentary list.

  1. If you click on a tag it would be great if it listed only questions with that tag.

Not quite what you asked for; clicking on a tag takes you to the list of site tags (with the clicked tag highlighted and scrolled into view). There you can find a link that shows all the questions with the tag.

I’ll update this post when we make progress with the other suggestion.

4 years
Jack Douglas replying to Anonymous 1552 — Monday, 5th Oct 2020 08:44

Good question — there hasn’t been any work on those but there is a plan on the drawing board to have a sorting dropdown. Are you mainly interested in sorting by popularity? As normal questions (outside Meta) don’t attract stars, we’d have to measure that by the popularity of answers…

an hour
Anonymous 1552 — Monday, 5th Oct 2020 07:19

Any update on suggestion 3?

4 months
Jack Douglas replying to Anush — Wednesday, 17th Jun 2020 18:52

No, they are high up the priority list — I’m keen to get them right though. For example we are thinking that clicking on a tag shouldn’t search directly, but take you to a tag list page where a second click can get you the search

an hour
Anush — Wednesday, 17th Jun 2020 18:06

Has work on these suggestions stalled?

a month
Jack Douglas — Sunday, 3rd May 2020 12:57

At some point I will want to ask you to sanity check or plan to store the keys hashed

Jack Douglas — Sunday, 3rd May 2020 12:56

If you drop a ‘hello’ in there I’ll be able to ping you in that room

Jack Douglas — Sunday, 3rd May 2020 12:56

^^^ that’s the best place to chat about development internals

Jack Douglas replying to ArtOfCode — Sunday, 3rd May 2020 12:55

Jack Douglas — a few seconds ago in Code Breakers

@ArtOfCode now has write access to this room too, so we can continue talking about security in here, if need be!

17 hours
ArtOfCode — Saturday, 2nd May 2020 20:19

Sure, no problem 😃

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 20:18

that is really very kind, much appreciated

ArtOfCode — Saturday, 2nd May 2020 20:18

Oooh, nice. They wanted that for ages on SE.

ArtOfCode — Saturday, 2nd May 2020 20:18

Happy to help, if I can be useful - I’m fairly useless with PHP and any more than basic SQL, but I know my way round web security 😃

Jack Douglas — Saturday, 2nd May 2020 20:18

TiO integration

Jack Douglas — Saturday, 2nd May 2020 20:18

we have a killer feature about to be release for testing into a private beta community 😃

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 20:17

also, thanks for the encouragement

Jack Douglas — Saturday, 2nd May 2020 20:17

thanks!

Jack Douglas — Saturday, 2nd May 2020 20:17

we’ll make it a priority to sort this out — I have half a plan

ArtOfCode — Saturday, 2nd May 2020 20:15

so, if all your attacker gets is a database full of strong hashes, it’s basically useless. If they get a database of cleartext passwords - which is effectively what the login key is - they can log in to every account

ArtOfCode — Saturday, 2nd May 2020 20:15

Point being that you can’t log into an account if all you’ve got is the hash - you’ve got to brute-force reverse the hash back to the password.

Jack Douglas — Saturday, 2nd May 2020 20:15

I’m getting confused with auth tokens I think

ArtOfCode — Saturday, 2nd May 2020 20:14

That… sounds like a misunderstanding. A password hash is basically one-way encryption. Once you’ve hashed it, you can’t get the original password back out of it. When someone logs in, you hash the password they tried and if it matches the one you’ve got stored, they gave you the right password.

Jack Douglas — Saturday, 2nd May 2020 20:13

I thought if an attacker got the hash they could log in to your account, but only for the compromised site

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 20:13

I may have overlooked something basic here

ArtOfCode — Saturday, 2nd May 2020 20:12

It’s less about what an attacker can get access to (okay, maybe they spam the site for a while with everyone’s accounts), and more about whether your users trust your security. If your passwords are hashed you can say “if an attacker gets our database, they still can’t log in to your account”. If they’re not and your database leaks, the attacker’s got every account on the site.

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 20:11

what is the other half?

ArtOfCode — Saturday, 2nd May 2020 20:11

Aye, but that’s bad enough. You do get to avoid the whole “steal password here, log in to bank” issue, but that’s only half of what hashing things is for.

Jack Douglas — Saturday, 2nd May 2020 20:10

I’m assuming no-one will reuse their login key here as theie FB password 😃

Jack Douglas — Saturday, 2nd May 2020 20:09

only access to your account here

Jack Douglas — Saturday, 2nd May 2020 20:09

I mean what would they give an attacker?

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 20:09

plain — but what are they? if you don’t set them yourself, there is no need to obfuscate them in the DB

ArtOfCode replying to Jack Douglas — Saturday, 2nd May 2020 20:09

How are the login keys stored at the moment?

ArtOfCode — Saturday, 2nd May 2020 20:08

I dunno, this UI is growing on me 😃 It’s certainly a big change from SO, which put me off originally, but it’s got some neat tricks.

Jack Douglas — Saturday, 2nd May 2020 20:08

I don’t think that is actually an advantage because a login key is like a crypted password

ArtOfCode — Saturday, 2nd May 2020 20:08

The other advantage username/password gives you is not storing the login tokens in cleartext in the DB - you can keep cleartest usernames, then bcrypt the password.

Jack Douglas — Saturday, 2nd May 2020 20:07

but using the same back-end through a json api

Jack Douglas — Saturday, 2nd May 2020 20:07

I’ve also wondered about having an entirely different front end with a more familiar SO-like skin including traditional auth

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 20:07

I’ve thought about adding it as an option — basically setting your login key to some kind of hash of your email/password for those that want it

ArtOfCode — Saturday, 2nd May 2020 20:06

Yeah, I get the concern about PII, for sure

ArtOfCode — Saturday, 2nd May 2020 20:05

How much effort would it be to switch to a username/password strategy? It doesn’t have to be email/password, it can be a user-chosen unique username.

Jack Douglas — Saturday, 2nd May 2020 20:05

but I think I want your PII even less

Jack Douglas — Saturday, 2nd May 2020 20:05

I don’t want that

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 20:05

this is true, and that is going to put people off

ArtOfCode — Saturday, 2nd May 2020 20:04

My concern is this - passwords may suck, but they’re so ubiquitous because they’re a good tradeoff between usability and security. This is a relatively untested strategy.

ArtOfCode replying to Jack Douglas — Saturday, 2nd May 2020 20:02

Aye, I’ve only just seen the post about them not being in a browser alert any more, which is definitely a good thing.

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 20:00

how do you mean ‘not copyable’ btw? you can copy PIN or access token from your profile

Jack Douglas replying to ArtOfCode — Saturday, 2nd May 2020 19:59

you mean to log in on a second device? perhaps the PINs don’t need to be quite so long — but a QR code would also be handy for the mobile case

ArtOfCode — Saturday, 2nd May 2020 19:56

@Jack I appreciate the lack of PII necessary to sign up, but (and I guess you’ve probably heard this before) I’d really appreciate having a username and password to log in elsewhere. The method of having to save a token that’s not copyable is a pain, especially if you don’t use a password manager.

2 days
Jack Douglas — Thursday, 30th Apr 2020 19:43

I think we can get rid of the ‘are you over 16’ popup too and add a second notification saying ‘please do not participate unless you are 16+’

Jack Douglas — Thursday, 30th Apr 2020 19:42

@Anush 4 excellent suggestions, thanks. The current plan with the joining dialogs is to remove them entirely, and rely on the automatic notification (which is a newer feature)

4 hours
FoggyFinder replying to Adám — Thursday, 30th Apr 2020 15:16

I think so

Enter question or answer id or url (and optionally further answer ids/urls from the same question) from

Separate each id/url with a space. No need to list your own answers; they will be imported automatically.