Passwordless login done right

You can easily deactivate it. Would I use this for sensitive data? probably not as I use a password vault, but for non sensitive sites this looks like quite a slick approach.

Re: Passwordless login done right

#5

Post by millsuk » Thu, May 21, 2015, 12:20 PM UTC

struct wrote: post #3

Cool idea, how is re-authentication handled beyond the initial sign up? Do you get a text message each time?

Push notification to your phone. They don't have iOS support yet which counts me out from trying it out.

Re: Passwordless login done right

#6

Post by glaberficken » Thu, May 21, 2015, 12:21 PM UTC

Users understand the Username/Password workflow.

Every attempt I've seen at improving this fails by introducing some new unexpected workflow complexity such as "sign in with google, fb etc" or "use your phone"

I think devs should instead focus their efforts on making that standard Username/Password flow work as effortlessly as possible.

Re: Passwordless login done right

#7

Post by olemartinorg » Thu, May 21, 2015, 12:21 PM UTC

I'm intrigued! But a few questions/comments:

* How is this two-factor? I only see one factor (a thing you have, your phone). Email adresses are not secret.

* Again, email adresses are not secret. How do you limit login-spamming? I don't want to wake up in the middle of the night because someone is trying to break into my account.

* What about timing attacks? If i stand over your shoulder while you're in the library - and i try to log in using your email address a few seconds before/after you, wouldn't you think "oh, probably a fluke" and allow my login? How would you differentiate between logins?

* If you're not that security-minded, you could have a desktop client as well - so you don't have to rely on your phone. At that point you could probably just have a browser plugin that does it all for you. (And at this point you're pretty close to what i already do with LastPass, although the site i'm visiting doesn't have to do anything special other that implementing a regular username/password login system.)

EDIT: Also, as far as i can see from the Play Store screenshots, the app only asks you "Do you want to log in at ?". A far better solution would be to show the user a number sequence (or a cute cat or dog picture) on both the login page and the phone. If those two mismatch, the login attempt is not from your session.

Re: Passwordless login done right

#8

Post by juriansluiman » Thu, May 21, 2015, 12:23 PM UTC

> Basically, this is an extremely secure, 2 form factor, idiot proof login system

As far as I know, factors are

1. Something you know (password)

2. Something you have (a dongle or phone)

3. Something you are (iris or fingerprint)

With only pressing a button on a phone, how can this be two-factor? There is no password ("passwords are obsolete" and usernames are not a knowledge factor in multi auth) and nothing of biometrics. Am I missing something?

By the way, not entering passwords is a fantastic way to login. I have been using the Passwordless [1] method for some time and it works great.

[1]: https://passwordless.net/

Re: Passwordless login done right

#9

Post by daigoba66 » Thu, May 21, 2015, 12:26 PM UTC

It's not two-factor. Your phone becomes an access card. Which is cool because you don't have to remember a password. But it's not two-factor.

Re: Passwordless login done right

#10

Post by sageabilly » Thu, May 21, 2015, 12:27 PM UTC

glaberficken wrote: post #6

Users understand the Username/Password workflow. Every attempt I've seen at improving this fails by introducing some new unexpected workflow complexity such as "sign in with google, fb etc" or "use your phone" I think devs should instead focus their efforts on making that standard Username/Password flow work as effortlessly as possible.

Meeting users where their understanding is now and not trying to drag them along to where their understanding should be is definitely a challenge with replacing traditional workflows (like username/password, swiping a credit card, letting the waiter carry your card off for swiping, etc). The issue I see with this is that it's introducing another step into the process instead of removing a step or making it easier. Now, instead of just remembering a username/password combo, you have to 1) remember a username 2) Remember that the website that you're visiting has the option to use unloq.io (because they're probably going to offer both unloq.io and the standard username/password) 3) enter in username 4) find your phone 5) unlock your phone 6) wait for confirmation on your phone 7) hit allow 8) look up, reorient yourself to your monitor and mouse, and continue.

Good UX involves taking away steps and streamlining flow, and until flow is streamlined and easier than the previous process users won't accept it.