Blog · a series
Signing in
One account for every Rutba site, and the parts of that nobody thinks about until one of them goes wrong: which realm checks your password, the second factor and where it lives, the last hop a browser is right to refuse, and where signing in should leave you.
6 parts · about 19 minutes to read them all
Part 1 · 3 min read
One sign-in for every Rutba site, and why it asks for your address first
Six Rutba sites used to disagree about whether you were signed in, and two of them collected passwords of their own. Now there is one front door. It asks who you are before it asks for a password — because it may not be the one that should check it.
Part 2 · 3 min read
A common word with a year on the end is still a common password
Our sign-up refused a short list of common passwords, exactly as written. Nobody types them exactly: they add a year, a row of digits or a symbol. The check now finds the word underneath, and leaves passphrases alone.
Part 3 · 3 min read
Your email address decides who checks your password
Sign in at Rutba and the first thing that happens is a question about your address, not your password. If your company runs its own Rutba, the centre hands you to it — and it answers the same way for an address that does not exist.
Part 4 · 4 min read
One place for your second factor, and a code you can scan
Turning on two-factor used to mean typing a thirty-two character secret by hand. It is a code you scan now, or a button on a phone — and the factor itself lives in one store rather than two, which is the part that keeps a settings page honest.
Part 5 · 3 min read
The password was right. The browser refused the last hop
A sign-in that looked like a wrong password was a security header doing its job too well: it allowed the form but not the page the form lands on. The fix was to build that rule from the list of places a sign-in is already allowed to end.
Part 6 · 3 min read
Where a sign-in should leave you: the app you hold, not a lobby
Signing in used to send everybody to the customer console, including people who hold no customer account. It now sends you to the one app you can actually open — and when you hold several, each is a row you can click rather than a name on a page.
