11–20 of 474 posts
Because of the developers of these apps assuming that E-mail guarantees instant delivery (it doesn't), I can't use greylisting, which reduced spam very significantly.
People have already been building auth flows that take this password amnesia into consideration. Look at Anthropic. It's just one way of doing auth and I personally hate it.
As long as the email account is secure, and the throw-away one-time passwords are good, you have the frequent-rotation passwords security advocates dream about. Indeed, hand them a secure password they have to use (and forget).
An email ties a user to a domain, the domain issues a user for them. If too many users from a domain are malicious, the website can block the domain.
It's a matter of identity and accountability.
I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…
Here’s my workflow, and I consider it superior to both of the above.
Go to site, Safari offers to autofill, give TouchID/FaceID, get asked for a 2 factor code.
Sent via SMS/email? Safari offers to autofill for me. TOTP style? Safari offers to autofill for me.
Easy peasy.
Passkeys are even easier as there is no second step and waiting for SMS/email.
People have already been building auth flows that take this password amnesia into consideration. Look at Anthropic. It's just one way of doing auth and I personally hate it.
I use a password manager. I don't like flipping back to my email, I already have a secure password.
People have already been building auth flows that take this password amnesia into consideration. Look at Anthropic. It's just one way of doing auth and I personally hate it.
I use a password manager. I don't like flipping back to my email, I already have a secure password.
People have already been building auth flows that take this password amnesia into consideration. Look at Anthropic. It's just one way of doing auth and I personally hate it.
I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…
Who copy and pastes from a password manager? Here’s my workflow, and I consider it superior to both of the above. Go to site, Safari offers to autofill, give TouchID/FaceID, get asked for a 2 factor code. Sent via SMS/email? Safari offers to autofill for me. TOTP style? Safari offers to autofill for me. Easy peasy. Passkeys are even easier as there is no second step and waiting for SMS/email.
People who don't use something which integrates with the browser. People who run into the (uncommon but noticeable) edge cases where the password manager decides to not auto fill the password.
Some apps enforce this flow, e.g. there is no way to log in with a password. I hate this. Because of the developers of these apps assuming that E-mail guarantees instant delivery (it doesn't), I can't use greylisting, which reduced spam very significantly.