151–160 of 474 posts
Facebook supported this for years, not sure why they recently deprecated it.
Not intentionally though - I have my password stored in 1Password, so I know it's correct, yet every time I try to purchase something through bestbuy.com I trip some sort of ATO protection that falsely claims my password is invalid.
I'm entirely willing to believe it's something on my side (ad blocker, local DNS blacklisting, etc.) but after a certain number of occurrances, you get bored trying to debug the problem and just follow the path of least resistance.
At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…
Some sites do that, like Netdata. But it's slow compared to my PW manager just autofilling a user/PW combo, since I have to wait for the email and go click the link.
Earlier quoted context omitted.
You didn't lose your entire savings if you lost your wallet, usually.
Perhaps micro wallets should be a thing where your wealth is distributed across many keys mitigating some loss.
I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.
I swear the McDonald’s app for the U.S. works like this on purpose. I’m prompted for my email then thus send me a link. They never ask me to set up a password.
Earlier quoted context omitted.
Self-hosting outbound email is hard. Self-hosting inbound email is trivial. Anybody will send email to any random domain, they're just not willing to accept it from random sources. And the latter is what is relevant for password recovery. I self-host inbound but use established servers for outbound through my ISP and have had no trouble with that setup for a while. Forwarding to people through my domain has gotten a…
> Self-hosting inbound email is trivial. Anybody will send email to any random domain, they're just not willing to accept it from random sources. In terms of authentication, this is not entirely true. It's less common these days, but I used to have a lot of trouble with sites rejecting my attempts to create accounts with e-mail addresses from my disposable-e-mail-generator of choice.
Well, I suspect those are more specifically blacklisted.
I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.
Because websites used emails as an identity, strictly in order to stop malicious use. An email ties a user to a domain, the domain issues a user for them. If too many users from a domain are malicious, the website can block the domain. It's a matter of identity and accountability.
And then the unsubscribe, close account, or basic support is all locked behind the login, or it's an international phone call. As far as I know, even if it's my email it's not legally my account so signing in would be illegal.