While the login system works...

It's ripe for abuse though. DMs are federated traffic and are not cryptographically secured in any form. So in theory a bad actor instance admin could spawn unlimited accounts and login... Or just sniff incoming requests from whatever instance this traffic is spawned from and obtain the login code.

For something like this, probably fine... But I wouldn't use it for anything else, nor would I trust any app that does use this system.

Quick! Everyone log in as osrsneedsf2p@lemmy.ml before the code expires :P

This is just a OTP, not technically OAuth, right?

I've seen you on the reddit alternatives sub, voat, ruqqus, and now here lmao. One day you'll get a non member osrs account.

What's an "OAuth"?

do I understand this correctly, it requires you to login to check your PMs for the code you need to login?

So far no bot infestations, was able to place some tiles and not run over by country flags ....yet