Remote device sign-in – Authenticating without a keyboard
summary
SoundCloud implements a remote device sign‑in for Xbox One that replaces controller typing with a short on‑screen code users enter at soundcloud.com/activate, backed by a long polling token so attackers cannot brute force the exchange. The team issues six‑character mixed codes (~4 billion combos), enforces rate limits, short expirations and device name confirmation, and exchanges a long device token for an OAuth access token. The flow is built, launched and reduces sign‑in friction substantially.
AI-written summary · about
chapters (7)
- 0:00Start
- 7:33UX considerations
- 12:04Don't use special characters 17&%
- 12:24Use UPPERCASE for readability
- 12:37Security considerations
- 14:04Accidentally granting access to someone else's device
- 22:13Closing thoughts
related talks
32mRemote device sign in
30mDevice Authorization Flow 101: Logging in From Input Constrained Devices
13mFuture-Proofing Authentication: From Biometric Logins to Passkeys with WebAuthn
21mPasswords are so 1990
01h 26mInteractive Session: Bridging the gap between the tech and the user
16mSign-in with Apple on Android devices?
50m.NET Rocks Live
18mGame On: The Journey of Passkey Launch