Passwordless sign-in

Why it sounds great

No sign-in. No email. No friction. The extension installs and instantly knows who you are. Many similar extensions take this route — they generate a random number when you install, or they fingerprint your device (the operating system, the screen size, the timezone, that sort of thing), and use that as your identity.

Sounds perfect. It isn't.

Why it falls apart in real life

A device or a browser is not the same thing as a person. Here are everyday situations where the "device = person" idea breaks, and what it means for the counts you see:

• You reinstall your browser. To the extension you are now a brand-new person. The reactions you left this morning are from "someone else" now. Or: someone trying to inflate a number just reinstalls.
• You use Chrome at work and Firefox at home. That's two different people, as far as the extension is concerned. Your reaction counts twice.
• You buy a new laptop. Old you is gone, new you appears.
• Your operating system updates and changes something tiny. Sometimes that's enough to "look like" a different device. New person.
• Two people own the exact same laptop model. They can end up looking identical to a fingerprinting system, even though they're different people. The system merges them. One real vote shows up as two — or two people share a single vote.

The end result is the same in every direction: the counts drift. They're either inflated by the same person being counted as several, or deflated by several people being counted as one. And anyone who wants to push a number around can just open a new browser profile — which is free, instant, and infinite.

Why it sounds great

Most apps these days have a "Continue with Google" button. It's familiar, it's one click, and it solves the "one person, one account" problem because Google already knows who you are. It would have been easy to bolt on.

Why we decided against it

Three reasons, and any one of them on its own would have been enough.

• Privacy. A "Continue with Google" button tells Google that you use Web Reactions. We don't think a tiny reactions extension has any business adding a row to your Google profile. Same for GitHub and Microsoft. You came to Web Reactions to leave an emoji on a Facebook post, not to broadcast that fact to a third party.
• Lock-in. If Google or GitHub decided, tomorrow, to disable Web Reactions's sign-in app, whether by mistake, by policy change, or by automated false positive, every single user would be locked out at once. Trusting our whole identity layer to a giant we don't control is a risk we don't want to take with your account.
• The "two accounts" problem. Lots of people have a work Google account and a personal one. With OAuth you can sign in with either, and the extension thinks you're two different people. That's the same problem as the device-ID approach, just dressed up nicer.

What you actually do

The first time you want to leave a reaction, Web Reactions asks for your email. We send a verification code. You paste it in. You don't have to do this again for a while. That's the entire flow:

1. Your email You type it once.
2. One-time code We mail a 6-digit code; you paste it in.
3. Email discarded Only an irreversible salted hash is kept.
4. Your account That hash is your account identifier.

Why this is the only honest option

• It's still you on every browser. Sign in with the same email in Chrome at work, Firefox at home, on your phone — same account, same history, same one vote per post.
• Reinstalling doesn't reset you. Your email didn't change, so neither did your account.
• It costs real effort to be fake. Making a hundred real, deliverable email addresses is much harder than opening a hundred browser profiles — and we turn away disposable addresses and domains that don't actually receive mail. That's the friction that keeps a count meaningful.
• No third party gets to know. You don't tell Google, GitHub, or Microsoft that you use Web Reactions. The only thing that learns your email is your own email provider — which already knows.
• Anyone with email can use Web Reactions. You don't need a Google account. You don't need GitHub. You don't need an account anywhere else. You bring your own email.

What happens to your email afterwards

We send the code over a secure connection, your email provider delivers it to you, you paste the code back, and then we forget the email itself. We don't save it. We don't sell it. We don't email you a newsletter — there isn't one. The only thing we remember is a one-way scramble of the email that lets us recognize "this is the same person" the next time you sign in. Even if someone broke into our database tomorrow, they could not recover your email address from what's stored there alone.

And in the public log of reactions you're never your email — or even a fixed ID. Each reaction is tagged with a rotating code that changes over time, so the public record can't be used to follow you from one post to the next.

And if you change your mind, the popup has a "Delete account" button. One click and the record is gone, and the reactions you left over time are subtracted back out of the counts they belong to.