The Reason

by kapowaz, Saturday, March 09, 2013, 08:40 (4066 days ago) @ Beorn

The auto-signout policy makes sense due to their multi-source authentication methods, but that doesn't keep it from being a pain in the ass.

It sounds like Bungie's hands are tied because the third-parties haven't implemented common sense authentication strategies like OAuth. If the third party issues a token which is valid for a finite period of time or until revoked then Bungie only needs to know that the token is still valid. This is why you don't have login frustrations on sites that use Twitter or Facebook as an authentication provider.

I was sure I remember hearing that all Microsoft Accounts (whatever name they're using now — it's been Passport, Live ID and a few others overs the past decade) could be used for OAuth purposes, but maybe I'm misremembering that?

What if, instead of a Sign-In menu, they had service buttons that you'd just click directly

If the weak link is the third-party auth, then that is the bit that should be sandboxed; there's no reason why Bungie couldn't have as flexible and long-lasting a session as they wanted just for bungie.net and anything that's not intrinsically related to a third-party service. But then maybe there's some reason they've decided not to do that?