If you develop web apps, don't do this.
sneak.datavibe.net
If you develop web apps, don't do this.
1–10 of 113 posts
Re: If you develop web apps, don't do this.
#2"Forgot your password" requests usually POST to the web server, not GET (what's usually used in emails). Sending links that give you complete control over the account by default seems like an extraordinarily bad idea--as does allowing users to reset their accounts without any kind of identity verification.
(You could do a POST from an HTML email, but then, in most email clients, the users would be prompted with "You are sending data to the web page. Do you want to continue?" every time they click such notifications.)
Re: If you develop web apps, don't do this.
#3"Forgot your password" requests usually POST to the web server, not GET (what's usually used in emails). Sending links that give you complete control over the account by default seems like an extraordinarily bad idea--as does allowing users to reset their accounts without any kind of identity verification. (You could do a POST from an HTML email, but then, in most email clients, the users would be prompted with "You…
> "Forgot your password" requests usually POST to the web server
No they don't. They usually just have some sort of password reset token as part of the query string for a standard GET. AFAIK there isn't any good way to POST from the body of an email - do mail readers even do JavaScript?
Re: If you develop web apps, don't do this.
#4If you create a blog, don't use fixed headers and footers that take up half a netbook's screen.
Re: If you develop web apps, don't do this.
#5"Forgot your password" requests usually POST to the web server, not GET (what's usually used in emails). Sending links that give you complete control over the account by default seems like an extraordinarily bad idea--as does allowing users to reset their accounts without any kind of identity verification. (You could do a POST from an HTML email, but then, in most email clients, the users would be prompted with "You…
Also, that's the core of my argument - the "click here to reset your password" link that is sent, on command, is a link that gives you "complete control over the account" without identity verification (other than your email box).
Re: If you develop web apps, don't do this.
#6If you create a blog, don't use fixed headers and footers that take up half a netbook's screen.
Sorry, I design for 2560x1600. I don't want poor people reading my site.
(That's a joke. I didn't even make the theme.)
Re: If you develop web apps, don't do this.
#7A good idea for some situations. There are some obvious caveats:
* Remember email is not encrypted. The links can be intercepted.
* Consider looking at other factors (like IP, browser data, persistent cookies) that will let you know the user is legit before you green light the auto-login.
* Link to HTTPS, not HTTP. The user might be on a shared computer and you don't want login-able URLs left in the history.
* Force the user to enter their password to access sensitive settings or data (like changing email, passwords, etc.)
Re: If you develop web apps, don't do this.
#8A good idea for some situations. There are some obvious caveats: * Remember email is not encrypted. The links can be intercepted. * Consider looking at other factors (like IP, browser data, persistent cookies) that will let you know the user is legit before you green light the auto-login. * Link to HTTPS, not HTTP. The user might be on a shared computer and you don't want login-able URLs left in the history. * Force…
The "click here to reset your password" links are sent over unencrypted email, too. I guess I am being insufficiently clear about why this is no less secure than what exists today.
> Force the user to enter their password to access sensitive settings or data (like changing email, passwords, etc.)
If they have to enter their password to change their password... then how will the "click here if you forgot your password" feature work?
Re: If you develop web apps, don't do this.
#9Down here
Re: If you develop web apps, don't do this.
#10Do what? Create database driven sites that can't handle the load? I get error messages or timeouts when trying to reach the site.