SecureLogin Authentication Protocol 1.0
This is a very interesting concept. I&#x27;m pretty sensitive to UX issues, and I&#x27;m yet to see nicely implemented and secure auth flows. All non-OS-native 2FA solutions (Google Auth, Duo) seem a bit cumbersome (and require additional efforts to implement and to setup for the average user). Apple does auth right with their Touch ID (both for logging in and to confirm transactions). I see a potential for SecureLogin to be as close to that Touch ID user experience as possible.<p>While I see the potential, I understand that this is an initial implementation, so it has UX issues:<p>1. First and foremost, the user has to download an app in order to sign into your service. That&#x27;s a huge ask. Service providers will be hesitant to implement this, since this will mean losing customers. The implementation has to be really polished for this to gain traction, IMO. Without getting initial traction, it&#x27;s less likely that this can be implemented natively in browsers&#x2F;OS, where this technology makes more sense and can have better UX. Kind of a catch 22.<p>2. Related to 1: A 50+MB Electron app is definitely not a casual download. It has to be as lightweight and OS-native as possible. For most likely use case (web app authentication), did you consider using browser extension that would store the data locally? Might be a good alternative to a downloadable app at least for that common use case.<p>3. When signing in, it asks if one has the app installed. I don&#x27;t want to be asked. If the app is not there, I want to have it installed in one click, and then have the auth retried. And visiting a separate <a href="https:&#x2F;&#x2F;securelogin.pw&#x2F;" rel="nofollow">https:&#x2F;&#x2F;securelogin.pw&#x2F;</a> site for downloads is not the best option as well. This bootstrapping process is very important. Again, a browser extension might help with this, since it can communicate with the page and make itself discoverable.<p>4. As I understand, Cobased is your reference demo app. As such, it needs more polishing&#x2F;explanation (read: some narrative in addition to the UI).<p>---<p>And a non UX-related question: nowadays people not only value security, but anonymity as well. Does SecureLogin have to pass profile email address back to the app? Can the protocol work in the way that simply uniquely identifies the user for the target service via providing some service-unique token but not disclosing an email address? In other words, the protocol might benefit from the fact that no one can link account on service A to the account on service B.