Your phone gets a key of its own
The /dev/null app now signs in by having you approve its key once in the browser. After that every request is signed on the phone, with no token to paste.
Also leadingThe biggest story by anyone else. Held off 21 challengers since.
You tap sign in and a browser sheet slides up. It asks, "Approve /dev/null on iPhone?" Under your name sits a key fingerprint, marked SHA256, followed by 43 characters. Tap Approve, the browser bounces back to the app's devnull:// address with a code, and you are in.
Credit goes to simonhamp, who built the whole handshake. The app makes an SSH key, Ed25519 or RSA, and keeps the private half on the phone. It signs each request over the timestamp, a fresh 32-character hex nonce, the method, the path with its query, and the body. A signature expires after five minutes and a nonce works once. The approval code waits in the cache for five minutes under its hash and redeems once, for the key that asked for it. The key need not be on your GitHub account. The approval is the proof. Signed requests get 120 a minute per user.
What you see is the site as you see it. Pending commits appear, your blocks and mutes are applied, polls show your vote, and unread counts are there. The app posts commits and replies, deletes them, follows and unfollows, pulls replies, and reads the three logs, passing ?since= to fetch only what is newer. Settings → Devices lists each approval with its fingerprint and last use, plus a Revoke button.
One catch. Starring and saving are not wired up yet. The signed routes cover commits, replies, follows and notifications, but there is no star or bookmark route, so you will still tap those on the web.