Remote device sign in
summary
SoundCloud builds a remote sign‑in flow for Xbox One that replaces controller text entry with a short user_code displayed on the console plus a long device_code used for secure polling. Device shows soundcloud.com/activate, polls every few seconds, and the phone or laptop (often already authenticated via fragment‑passed token in a webview) confirms the code; server exchanges device_code for an access token. Implementation uses 6‑char codes (~1 billion space), rate limits, short expirations (~5 minutes), and UI cues to prevent typos and social‑engineering; rollout succeeds.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:32Who am I
- 1:34What is remote sign in
- 2:30Why remote sign in
- 3:25Concept
- 6:57Confirmation
- 7:18Access Token
- 7:37Google Signin
- 8:16authenticated session
- 8:32remote sign in
- 11:46choosing codes
- 15:47Roman characters
- 17:16Wrong user
- 18:17Authentication
- 19:56Mitigation
- 20:34Collecting device information
- 21:30Using up all possible codes
- 22:16Rate limiting
- 23:23Pool of codes
- 23:40Bruteforce attack
- 25:05How to mitigate risk
- 27:28Social engineering attack
- 29:04How to mitigate
- 31:21Closing thoughts
related talks
23mRemote device sign-in – Authenticating without a keyboard
30mDevice Authorization Flow 101: Logging in From Input Constrained Devices
50m.NET Rocks Live
16mSign-in with Apple on Android devices?
01h 26mInteractive Session: Bridging the gap between the tech and the user
25mDiscover How to Streamline User Onboarding With Network APIs
51mWeb APIs for delightful two factor auth experiences
21mPasswords are so 1990