Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

351–360 of 474 posts

Re: The "email is authentication" pattern

#351

Post by depaya »

comprev wrote: post #348
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

If you accidentally burn cash you cannot recover it. The paper in your hand isn't replicated in another place. Humans have been unable to recover from mistakes since day zero

That is a funny example to use because the US Government has a service specifically designed to help you in that situation: https://www.bep.gov/services/mutilated-currency-redemption

Yes obviously if your money is completely burned then it's gone, but that is generally pretty unlikely to happen. Losing your digital key is many orders of magnitude more likely to happen in my opinion. And there is - by design - absolutely no way to get it back. That makes using blockchain for anything serious completely untenable in my opinion.

Re: The "email is authentication" pattern

#352

Post by eddd-ddde »

WA wrote: post #346
lwansbrough wrote: post #339

We run a pretty unserious business. That is, our users use our accounts only out of convenience. The system we've settled on is this: 1. User enters email 2. We send a verification code to their email 3. User enters code, is signed in "indefinitely" (very, very long cookie) Whether or not they had an account before hand is irrelevant, we just register a new account if the email is new. The occasional user has multipl…

I run a small B2C app. Users sign up with their email address only, a password field isn't even present. This creates the account and logs in the user "indefinitely" on this device. If they ever need to login on another device, they can request a new password. This way, this removes a) signup friction und b) weak passwords, because most people never need to login on another device anyways.

I like the concept but at the same time I hate having to open my email to login to a site.

I already have a password manager. I rather just generate a password on one go.

Re: The "email is authentication" pattern

#353

Post by kgwgk »

afastow wrote: post #300
kgwgk wrote: post #296

Earlier quoted context omitted.

In the first case, bank deposits are insured. In the second case, safe deposit boxes are not insured.

They're just different things. The FDIC insurance is for if the bank itself goes insolvent and they literally don't have enough money to cover their depositors' balances anymore. There's no reason a safe deposit box would be affected.

Yes, they are different things. A safe deposit box wouldn't be affected by the banks insolvency.

A safe deposit box may be affected by other things and if those things happen they don't have to "make it right", if you go to the courts and make your case you may find that they are not at fault and you are not owed any compensation.

Re: The "email is authentication" pattern

#355

Post by rollcat »

lwansbrough wrote: post #339

We run a pretty unserious business. That is, our users use our accounts only out of convenience. The system we've settled on is this: 1. User enters email 2. We send a verification code to their email 3. User enters code, is signed in "indefinitely" (very, very long cookie) Whether or not they had an account before hand is irrelevant, we just register a new account if the email is new. The occasional user has multipl…

Second this, used this approach on a tiny CRUD app that was essentially a single form. The amount of support requests (approx. zero) throughout the campaign was absolutely worth it.

Re: The "email is authentication" pattern

#356

Post by sq_ »

cmeacham98 wrote: post #345
t0mas88 wrote: post #342

Earlier quoted context omitted.

This is also (from the data that I have seen) by far the best approach to maximise ecommerce revenue. Don't force buyers into an account, just ask their details (the browser will autocomplete anyway). Send an email afterwards with a link to check their order status. Next order, ask for their email again. Any extra friction costs more in lost revenue than the benefits of having "signed up" users.

Wouldn't the best approach be not to ask for an email at all (or only optionally for receipt)?

I would imagine that plenty of users these days wouldn't bother to save their order details on the grounds that "oh, I'll get a notification with those".

Personally, I appreciate getting an email with details and a link for tracking. It does get annoying when it turns into low-grade spam, though.

Re: The "email is authentication" pattern

#357

Post by 4ad »

bmitc wrote: post #327
bombcar wrote: post #309

Earlier quoted context omitted.

Apple has made the incredibly annoying “you can’t just enter your 1Password/keychain password, you have to dick around with email” process much nicer; at least when it can recognize the email/text and enter the code for you.

Apple is the worst about this. The only option is that they send a message to an Apple device. I only have an iPad and not an iPhone or Macbook, so I often simply cannot log into my Apple account because they refuse to do anything else besides send it to an Apple device.

Not true, you can use FIDO2 keys. You can even use SMS (but you shouldn't).

Re: The "email is authentication" pattern

#358

Post by lwansbrough »

eddd-ddde wrote: post #352
WA wrote: post #346

Earlier quoted context omitted.

I run a small B2C app. Users sign up with their email address only, a password field isn't even present. This creates the account and logs in the user "indefinitely" on this device. If they ever need to login on another device, they can request a new password. This way, this removes a) signup friction und b) weak passwords, because most people never need to login on another device anyways.

I like the concept but at the same time I hate having to open my email to login to a site. I already have a password manager. I rather just generate a password on one go.

I agree it's inferior to a password manager but I think passkeys will usurp the role of password managers in the long term, and for everyone else who won't use either, a simple email is an easy ask -- better than having them go through password reset every time they use the site.

Re: The "email is authentication" pattern

#359

Post by dw_arthur »

6510 wrote: post #344
montroser wrote: post #119

I am one of those people who always clicks "forgot password", and sorry but it's actually fine. I type a long, completely nonsense sequence of words and characters for my new password, then ctrl-c to copy, then log in with that password, and then promptly forget it. It cannot be more secure to store it in a password manager than not to store it at all. The email recovery path exists in either case, so that part is a…

you may lose the email

I only do this on websites where I don't care if I lose the account. I use a password manager for anything that is critical.
Post reply on HN