# New login methods for chat **URL:** \ **Category:** đź‘Ť Improvements\ **Tags:** feature-request, chat\ **Created:** [July 3, 2023, 5:56pm UTC](https://forum.spinitron.com/t/new-login-methods-for-chat/989 "2023-07-03T17:56:04Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![tom](https://forum.spinitron.com/user_avatar/forum.spinitron.com/tom/32/343_2.png) [@tom](https://forum.spinitron.com/u/tom)\ **Post date:** [July 3, 2023, 5:56pm UTC](https://forum.spinitron.com/t/new-login-methods-for-chat/989/1 "2023-07-03T17:56:04Z")
In this topic I want to start the conversation and I’ll update the requirements here if I get any feedback. Last week at the NFCB conference in Denver Mike Lupica of WPRB reported that the current login options are insufficient, especially for younger users. The problem was discussed also in one of the sessions. I agree. The question is therefore: What auth methods to add and how exactly should they work? We could add more apps like maybe TikTok or whatever and that might help but it isn’t really satisfying for a number of reasons I can’t be bothered to elaborate here. What else might we do? Trick question! Serious engineers prefer to elaborate requirements before suggesting solutions. ### Requirements - Sock puppet mitigation - Low friction. It must be easy to chat for the first time and to resume chatting. - Chat with one display name over multiple devices and browsers - Phishing mitigation - Spam mitigation - No passwords ### Phones for ID and auth That last point about WhatsApp made me think. Let’s require phones for auth and use the phone number for ID. Since we rolled out chat it’s become normal to require mobile phones for participating in much of real life, or at least for convenient participation. Flying without a phone these days is way harder than submitting to the tyranny of the app. We’re not proposing to get rid of FB/Google auth so if you want not to use a phone directly with Spinitron, you can. ### _Phone number → pass code → cookie_ functional spec We’re mostly quite familiar with getting a 6-digit code via a text/SMS message and entering it into a web app. Can we apply this to chat and meet our requirements? A possible app flow: - In Spinitron chat, choose **Log in with text message** (or something) - Spinitron prompts for a phone number, which user enters - Spinitron sends a pass code in a text message and prompts for it - User enters the pass code - Spinitron validates the pass code - If Spinitron has no display name saved for that phone number, prompts for a chat display name, otherwise skip this prompt and use the saved name - Set a cookie for, say, 1 month - You’re in! On another device or browser or in a new private browser window you’ll need to log in again with text message and pass code and then you’ll be in for a month with that cookie in that browsing context. As with existing chat login, the display name will be reserved to your ID (phone number in this case) for a few more months after your last login. - Pros - Cons ### Bitwarden passwordless.dev Bitwarden sells a password manager app/service (like Lastpass, Dashlane, KeePass etc.). They are relatively new and open source. They also offer a login service called [Bitwarden passwordless.dev](https://bitwarden.com/products/passwordless/) which is their commercial implementation of [FIDO2 Web Authentication](https://fidoalliance.org/fido2-2/fido2-web-authentication-webauthn/). Their service comprises auth servers “in the cloud” and a client library that we could incorporate into Spinitron. I haven’t read much about it yet but it seems to provide the kind of ID and auth that meets our requirements set out above. Afaict, relative to _phone number → pass code → cookie_ described above we have… - Pros - Cons I suppose we could develop our own FIDO2 WebAuthn based on published specs and reference code if we wanted to avoid these two cons. ---
**Author:** ![tom](https://forum.spinitron.com/user_avatar/forum.spinitron.com/tom/32/343_2.png) [@tom](https://forum.spinitron.com/u/tom)\ **Post date:** [July 5, 2023, 1:44pm UTC](https://forum.spinitron.com/t/new-login-methods-for-chat/989/2 "2023-07-05T13:44:21Z")
I’m starting to think [WebAuthn](https://www.w3.org/TR/webauthn-1/) is the right way to go in general, not just for chat. Bitwarden’s implementation provides the authenticator in “the cloud” together with admin console webapp (for managing users and accounts), a JS library for our users, and Spinitron is the Relying Party. If it is certified by FIDO and easy to use then we can try it. There may be better options, idk. ---
**Author:** ![Mike\_WPRB](https://forum.spinitron.com/letter_avatar_proxy/v4/letter/m/ecd19e/32.png) [@Mike\_WPRB](https://forum.spinitron.com/u/Mike_WPRB)\ **Post date:** [July 12, 2023, 2:08pm UTC](https://forum.spinitron.com/t/new-login-methods-for-chat/989/3 "2023-07-12T14:08:52Z")
Thanks for bringing this up, Tom. I’m not a computer tech/coding guy, just someone who’s concerned about user experience and is definitely seeing a trend towards folks being disinclined to connect all of their online activities with big tech or social media. The playlist chat has been hugely successful listener engagement tool for us, but we’d like to see ways that would attract a broader cross section of our listeners. ---
**Author:** ![tom](https://forum.spinitron.com/user_avatar/forum.spinitron.com/tom/32/343_2.png) [@tom](https://forum.spinitron.com/u/tom)\ **Post date:** [July 12, 2023, 3:18pm UTC](https://forum.spinitron.com/t/new-login-methods-for-chat/989/4 "2023-07-12T15:18:20Z")
Yeah, I get it and I think you’re right to push the matter. I know your not a computer specialist but can you glean enough from my text above to get the idea of the practical difference between the two proposals I gave from a user’s point of view? ---
**Author:** ![Amanda\_Shauger](https://forum.spinitron.com/user_avatar/forum.spinitron.com/amanda_shauger/32/20_2.png) [@Amanda\_Shauger](https://forum.spinitron.com/u/Amanda_Shauger)\ **Post date:** [February 16, 2024, 8:37pm UTC](https://forum.spinitron.com/t/new-login-methods-for-chat/989/5 "2024-02-16T20:37:36Z")
Just stumbling on this as I look up another chat function. Fascinating discussion. What did you land on. ---
**Author:** ![tom](https://forum.spinitron.com/user_avatar/forum.spinitron.com/tom/32/343_2.png) [@tom](https://forum.spinitron.com/u/tom)\ **Post date:** [February 17, 2024, 8:10pm UTC](https://forum.spinitron.com/t/new-login-methods-for-chat/989/6 "2024-02-17T20:10:09Z")
We have a research project ongoing looking at this. > **[Bitwarden Passwordless.dev | Bitwarden](https://bitwarden.com/products/passwordless/)** > > Embrace the speed of passkey authentication with Bitwarden Passwordless.dev, empowering developers to quickly build seamless user login experiences with standard FIDO passkeys. Get started today. Using this you’ll be able to log in to chat using a phone as an authenticator device. Once you’ve done that you’ll be able to use your phone to authorize a chat login from browsers on any other device or computer.