It's exchanging one authentication factor (something you know) with another (something you have), while negatively impacting UX (by adding email UX issues) and not adding meaningful security.
Ask HN: Why not to use passwordless login?
21–30 of 36 posts
Re: Ask HN: Why not to use passwordless login?
#22While passwords are still my preferred method, I was trying to think about ways to incorporate a passwordless system.
I like the method that Slack has.. while they offer the old method of logging in with a password, their other method is to send your email a link and then once that link is clicked, they set a cookie indefinitely.
The other way is once a user registers for an account, they get an email to login, but before they can login, they have to enter in their phone number, so then from then on out, every time they enter in their email, they will get sent a text message and simply have to enter in a code.
It is still not technically passwordless, but it certainly is a unique method to have people login.
No matter how far we come though, the username and password seem to still be our best method of knowing WHO YOU ARE and verifying the account belongs to you.
Re: Ask HN: Why not to use passwordless login?
#23That's just the "forgot password" system, minus the convenient option of entering a password instead of waiting... and waiting... and waiting... and checking your spam folder... and waiting some more... for the email with the auth code to arrive. Not actually an advantage, in my eyes.
Re: Ask HN: Why not to use passwordless login?
#24I think OAuth logins are a nice compromise. "Login with Google / Facebook / ..." with one click works well! Unfortunately, some sites use it to just get your email address, and still require you to make a password for them, which defeats the purpose and decreases user trust in the benefits of going through the flow.
This can be pretty annoying for users and developers though. If the user forgets what account they last used and selects a different one next time then it ends up creating an entirely new account unassociated with the first. If I ever do social integration, I require a plain old email based login first and then allow them to connect their social accounts to it.
Re: Ask HN: Why not to use passwordless login?
#25Plenty, both in terms of security and UX: 1.) It's less secure (unless the email is encrypted, which in most cases it is not). 2.) If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email. 3.) Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the pur…
> It's less secure (unless the email is encrypted, which in most cases it is not) I disagree. With opportunistic encryption, if the recipient' server supports STARTTLS, then the communication between the sender' server and the recipient' server is encrypted using TLS. Nowadays, all major email service providers support STARTTLS. > If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fi…
> Just use the GMail to avoid the delay with fetching third party accounts.
"Don't use the email client you prefer" isn't really a great argument against it being bad UX...
Re: Ask HN: Why not to use passwordless login?
#26I think OAuth logins are a nice compromise. "Login with Google / Facebook / ..." with one click works well! Unfortunately, some sites use it to just get your email address, and still require you to make a password for them, which defeats the purpose and decreases user trust in the benefits of going through the flow.
This can be pretty annoying for users and developers though. If the user forgets what account they last used and selects a different one next time then it ends up creating an entirely new account unassociated with the first. If I ever do social integration, I require a plain old email based login first and then allow them to connect their social accounts to it.
One way around this (from the developer's side) is to federate together different identities for a user using something like dex [1], and segregating your login and signup paths, so attempts to login will never create a separate account.
Re: Ask HN: Why not to use passwordless login?
#27they are
- unaware of it
- lazy to make a change
I use passwordless login at, for example, my website https://playforitsownsake.com and I don't have to request a password that every single time I go there because a login lasts for 2 weeks.
Re: Ask HN: Why not to use passwordless login?
#28Why would I want to go through the hassle of requesting a new non-password to be sent to my email, wait to receive my non-password, and then log in using that non-password every single time I want to log in? I will happily let my web-browser remember my password, or store it in a password manager if it needs to be secured.
Square Cash is the most prominent example I know of for an email-based passwordless login system, and I personally really like it.
> then log in using that non-password every single time I want to log in?
The key piece of UX in these systems is you don't make the user do this every time, but rather only when logging in on new devices, and after a reasonable expiration date, say 30 days.
For the average HN user, this might not be much of an improvement in terms of security or UX compared to a regular password system when used with a good password manager. The average internet user is and always will be much less sophisticated, however, and is someone who can manage to regularly forget even their really crappy passwords (if they use more than 1 password to begin with).
For the average user, I think this system improves both UX and security by a large degree because for UX, it removes the need to remember more than 1 password (the password to your email serves as your master password), and for security, it verifies identity using the ability to access an email and a device (browser) rather than the mere knowledge of an email and a password.
Re: Ask HN: Why not to use passwordless login?
#29Plenty, both in terms of security and UX: 1.) It's less secure (unless the email is encrypted, which in most cases it is not). 2.) If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email. 3.) Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the pur…
> It's less secure (unless the email is encrypted, which in most cases it is not) I disagree. With opportunistic encryption, if the recipient' server supports STARTTLS, then the communication between the sender' server and the recipient' server is encrypted using TLS. Nowadays, all major email service providers support STARTTLS. > If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fi…
> I disagree. With opportunistic encryption, if the recipient' server supports STARTTLS, then the communication between the sender' server and the recipient' server is encrypted using TLS. Nowadays, all major email service providers support STARTLES.
With regular passwords via a browser, you can ensure the channel is encrypted via HTTPS.
Opportunistic encryption is exactly that: it uses encryption if it can, but will fallback to unencrypted if not.
How is "sometimes encrypted, if its available" not less secure than "always encrypted, unavailable if encryption doesn't work"?
> Just use the GMail to avoid the delay with fetching third party accounts.
So, you're simultaneously suggesting that everyone use 'email links for login' and suggesting everyone use a single email provider? Sure, that doesn't sound terrible at all.
> most users don't use a password manager
What's your basis for this? Every browser in use today has a password manager built in. People promoting these bullshit "not a password" alternatives always claim "average people" don't use password managers, but never present any evidence of that.
> If the user uses an email server that doesn't support STARTTLS, then theoretically an attacker could request a password reset and "catch" the unencrypted email.
Firstly - the main security concern with emailed 'login' links isn't the transport at all - it's storage/accessibility via the mailbox. Breach the mailbox, and you've breached the third party sites. The part people always ignore when suggesting emailed links as an alternative, is that if an attacker breaches your mailbox, they could conceivably use that to access your third party service that uses login links, and the victim would never know, because there is no password being reset, no killing of previous sessions.
> My conclusion: Passwordless login is an interesting solution. But there are other issues to consider, discussed in other comments (email delivery latency/greylisting, ergonomy, need to remember which email address you used, etc.).
My conclusion: password-less login is a thing that exists via public key cryptography: see ssh, TLS client certificates. Emailing links to people is nothing more than a fucking stupid idea, and frankly it's ridiculous that your "other issues to consider" makes literally zero mention of any security concerns.
Re: Ask HN: Why not to use passwordless login?
#30Why would I want to go through the hassle of requesting a new non-password to be sent to my email, wait to receive my non-password, and then log in using that non-password every single time I want to log in? I will happily let my web-browser remember my password, or store it in a password manager if it needs to be secured.
Certificates are used but can be a hassle cross platform. Email is insecure so I don't love that idea. Emails are plaintext moving around the internet and can be snooped on (doesn't mean they are but much easier than a TLS client to server connection