If widely adopted, then a compromised e-mail could lead to much deeper access than a single compromised password would (except for those who use the same pw everwhere). I understand the motivation, and agree re: the issues of passwords, though.
Why we went passwordless on our new product
11–20 of 76 posts
Re: Why we went passwordless on our new product
#12Email links mean I can't login from someone else's pc because I don't have my email setup on it. I find that very bad UX
Re: Why we went passwordless on our new product
#13Email links mean I can't login from someone else's pc because I don't have my email setup on it. I find that very bad UX
In this day and age, you should not login to anything from someone else's PC.
Re: Why we went passwordless on our new product
#14I don't get it. Both Chrome and Firefox come with password manager which can auto-generate strong, unique passwords. Magic links are nice, but they should not be the only option.
Re: Why we went passwordless on our new product
#15Quite a few standard password login flows have a "magic link" stream already, in the guise of password recovery -- enter your username on a link, click "forgot password", and get an email with a magic link allowing you to log in (after resetting the password). Which means the security model is not, in some cases, exactly what it appears to be...
Re: Why we went passwordless on our new product
#16So now there is a minimum of three companies involved (spike, magic, the email provider) just to log me in - and there is still a password that can be leaked, the one for my mailbox. Great...
Re: Why we went passwordless on our new product
#17Email links are a great password system on a "mobile first web". Not so much when you are using a desktop..
Re: Why we went passwordless on our new product
#18Magic links are really REALLY annoying if cookies get removed often or if you don’t have access to email. Offer a password option, people! Back it up with a magic link if you must but offer a password! Especially if your magic links go to spam.
Its an even bigger friction for users, essentially I have to login to another service to login to yours.
Re: Why we went passwordless on our new product
#19One thing I like about the implementation that magic.link provide which isn't clear from reading the article is that the device you use to log into the passwordless service and the device you use to log into your email can be different. For example, I can log into this incidents.sh service on my work PC and click the one-time link on my phone and it will work. No need to sign into my email account on my work PC.
Re: Why we went passwordless on our new product
#20Quite a few standard password login flows have a "magic link" stream already, in the guise of password recovery -- enter your username on a link, click "forgot password", and get an email with a magic link allowing you to log in (after resetting the password). Which means the security model is not, in some cases, exactly what it appears to be...
Those can be actually worse because you end up having to choose a different password every time, and you're probably not going to make it stronger every time you forget...