Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why not to use passwordless login?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 36 posts

Re: Ask HN: Why not to use passwordless login?

#11

Post by pavel_lishin »

shanecleveland wrote: post #7
pavel_lishin wrote: post #4

As a consumer of services, it's not more convenient for me than clicking the Lastpass (or your password manager of choice) icon and filling in the login form. Plus, I imagine some people may have multiple email accounts, and would have to hunt through them to figure out which one they used to sign up with. (Similar to my problem with StackOverflow; I can never remember which identity provider I used to sign up with t…

Not saying your are wrong in your preference, but you can similarly use a password manager to save the email address used for a password-less login. So perhaps not a good argument against passwordless logins in general, though I am sure there are many good reasons against it. So far, the few arguments against here are individual, convenience-based reasons. Those are certainly valid reasons, because if you inconvenien…

> you can similarly use a password manager to save the email address used for a password-less login

Sure, but it still adds an extra step; my current manager doesn't have a "log into the email address you used to register with this site" button.

But you're right, there are advantages to email-based login.

Re: Ask HN: Why not to use passwordless login?

#12

Post by cpburns2009 »

Why would I want to go through the hassle of requesting a new non-password to be sent to my email, wait to receive my non-password, and then log in using that non-password every single time I want to log in? I will happily let my web-browser remember my password, or store it in a password manager if it needs to be secured.

Re: Ask HN: Why not to use passwordless login?

#14

Post by Scaevolus »

I think OAuth logins are a nice compromise. "Login with Google / Facebook / ..." with one click works well!

Unfortunately, some sites use it to just get your email address, and still require you to make a password for them, which defeats the purpose and decreases user trust in the benefits of going through the flow.

Re: Ask HN: Why not to use passwordless login?

#15

Post by shanecleveland »

pavel_lishin wrote: post #11
shanecleveland wrote: post #7

Earlier quoted context omitted.

Not saying your are wrong in your preference, but you can similarly use a password manager to save the email address used for a password-less login. So perhaps not a good argument against passwordless logins in general, though I am sure there are many good reasons against it. So far, the few arguments against here are individual, convenience-based reasons. Those are certainly valid reasons, because if you inconvenien…

> you can similarly use a password manager to save the email address used for a password-less login Sure, but it still adds an extra step; my current manager doesn't have a "log into the email address you used to register with this site" button. But you're right, there are advantages to email-based login.

You're right about that extra step, which may be crippling enough to keep users away.

Re: Ask HN: Why not to use passwordless login?

#18

Post by ngrilly »

BjoernKW wrote: post #5

Plenty, both in terms of security and UX: 1.) It's less secure (unless the email is encrypted, which in most cases it is not). 2.) If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email. 3.) Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the pur…

> It's less secure (unless the email is encrypted, which in most cases it is not)

I disagree. With opportunistic encryption, if the recipient' server supports STARTTLS, then the communication between the sender' server and the recipient' server is encrypted using TLS. Nowadays, all major email service providers support STARTTLS.

> If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email.

Just use the GMail to avoid the delay with fetching third party accounts.

> Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the purpose for the operator to have a less complex authentication system to worry about).

I mostly agree, but:

1/ Alas, most users don't use a password manager. They keep reusing the same passwords on multiple websites, which is a serious security risk.

2/ If the user uses an email server that doesn't support STARTTLS, then theoretically an attacker could request a password reset and "catch" the unencrypted email.

My conclusion: Passwordless login is an interesting solution. But there are other issues to consider, discussed in other comments (email delivery latency/greylisting, ergonomy, need to remember which email address you used, etc.).

Re: Ask HN: Why not to use passwordless login?

#20

Post by ngrilly »

The main issue with passwords is that non-technical users tend to reuse the same password, which is a serious security risk. This is, in my opinion, the best reason to use a passwordless login. A better solution would be, when the user create his/her account or reset his/her password, to generate a random password, instead of letting the user choose a password. I'm curious about this approach. As anyone tried something similar?
Post reply on HN