Hacker News new | past | comments | ask | show | jobs | submit login

If they're going to use a password manager then the password manager will tell them. Your system can't determine if the user signed up with Google or is using an electronic id card either.



Yes, it can. How do you think Auth works? You know what auth methods the user has. Otherwise you can't really validate their auth.


If you're using an electronic id card then you don't have the same username and password values that your website uses. You likely won't even use the same fields. Authenticating through that usually just involves a separate button.


Auth systems don't key off of usernames... When we added FIDO support there's still a backing user store that records user x has FIDO y, with a recording of the public key. That's how the pairing works. You can see it today on login.live.com




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: