Passwordless Products
blog.bolt.co
Passwordless Products
1–10 of 59 posts
Re: Passwordless Products
#2I really love when I see products take this route. I'm also currently working on something that is passwordless. I think there is a small cognitive hump that new users have to get over, but I'm working on ways to make it smoother. Nonetheless, I believe this route is the future & we will continue to see more passwordless products, which will increase the general understanding of how to use them.
Re: Passwordless Products
#3Why do people seem to think they're the first to dream this up? Dozens of products don't use passwords because they use federated login, or they use Persona/BrowserID, or because they use a secure token via email. It's been done for basically forever.
Please just go the Persona route though, it's so much less annoying and less of a hack than the email a secure link route.
Re: Passwordless Products
#4I think this is generally an improvement over the status quo but it doesn't solve the problem we've created with email being our single point of security failure. From where I stand, the only sane way forward is to stop storing data in these big juicy silos that are very attractive targets for hackers (gmail).
Re: Passwordless Products
#5I recently built passwordless, email-based authentication into the iOS app I develop (http://varka.la). Still tweaking how it's messaged, though, as folks seem to be a little confused about how it's different than a normal registration flow one might see in another app.
Re: Passwordless Products
#6I think this is generally an improvement over the status quo but it doesn't solve the problem we've created with email being our single point of security failure. From where I stand, the only sane way forward is to stop storing data in these big juicy silos that are very attractive targets for hackers (gmail).
Totally agree. GMail with two-factor auth is a good solution, but then we're back to hoping that users adopt a relatively niche and optional security improving feature.
Re: Passwordless Products
#7I think this is generally an improvement over the status quo but it doesn't solve the problem we've created with email being our single point of security failure. From where I stand, the only sane way forward is to stop storing data in these big juicy silos that are very attractive targets for hackers (gmail).
What if each user had a personal data store, either running on a server they pay for, or one that they host themselves, at home? All their blog posts, comments, pictures, videos, location history, and everything else, is owned by them. They just give sites permission to access (create, read, update, delete) their data.
I'd love something like that, as a user. As a developer, it may make some things harder or slower. I'd totally be willing to pay that price though, if it meant never having to be responsible for thousands of user's data again. The user becomes responsible for their own data.
Re: Passwordless Products
#8So if the token expires, how do you log back in? What happens if you want to use a different browser? Or buy a new computer?
Re: Passwordless Products
#9Have you heard of 2-factor authentication? Sounds pretty much like what you described. Specifically, the way Duo Security implements SSH logins.
Re: Passwordless Products
#10I've wanted to bite the bullet with this, but not enough of a security expert to do it confidently. How does this stack up?
I like the idea of keeping someone logged in, then they can choose to log back using whichever means they decided when creating their account - email, SMS, authenticator app.