Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why we went passwordless on our new product

spike.sh

Post reply on HN
Print view View original

21–30 of 76 posts

Re: Why we went passwordless on our new product

#21

Post by xg15 »

loceng wrote: post #6
hprotagonist wrote: post #3

Earlier quoted context omitted.

>What can happen is better federated SSO using OAuth2 like Apple, Google, FB, Github, and/or similar for web applications to defer or eliminate yet another mandatory password. Then you get locked out of like 9 things at once when {you ragequit github for political reasons and forget to migrate everything , google kills yet another thing, google locks your account for funsies, apple locks your account until your macbo…

Security requires good governance and trust - and ultimately realizing that everything connected online can and will likely be breached - and so if something is important enough, the design should be that it never touches the network. I personally don't fear any of my history or life coming out if it were - at least at this point, and in reality if security becomes a real concern due to well, tyranny and the universa…

> Security requires good governance and trust

Neither of which the web currently has.

Re: Why we went passwordless on our new product

#23

Post by spuz »

eplanit wrote: post #11

If widely adopted, then a compromised e-mail could lead to much deeper access than a single compromised password would (except for those who use the same pw everwhere). I understand the motivation, and agree re: the issues of passwords, though.

Could you explain why? Is it because a log-in request essentially looks exactly the same as a "forgot password" request and is likely to slip under the radar of someone monitoring for suspicious activity?

Re: Why we went passwordless on our new product

#24

Post by spuz »

kyriakos wrote: post #12

Email links mean I can't login from someone else's pc because I don't have my email setup on it. I find that very bad UX

You don't need your email set up on someone else's PC in order to log into a service which uses passwordless login. You only need access to your email from some device - not necessarily the device which you want to log in with.

Re: Why we went passwordless on our new product

#25

Post by reaperducer »

galfarragem wrote: post #17

Email links are a great password system on a "mobile first web". Not so much when you are using a desktop..

Email links are a great password system on a "mobile first web". Not so much if you are using a desktop..

How so? I only have one service that I use which employs magic links, and I use it on a desktop with no problems.

I'm starting an internal project for my company which will utilize magic links. About 50% of the users are expected to be on desktop, and 50% on iPads, so I'd like to know what the problem is for desktop users before I go too far.

Re: Why we went passwordless on our new product

#26

Post by xg15 »

kyriakos wrote: post #12

Email links mean I can't login from someone else's pc because I don't have my email setup on it. I find that very bad UX

As I understood the service, it does not require that you click the link on the same machine that you login from. In fact, the screen shots sort of assume that you open the mail on your phone even if you login from your desktop.

Re: Why we went passwordless on our new product

#27

Post by gingerlime »

I’m not convinced and personally find it irritating. One data point I can share: Know your team (ex Basecamp) moved from magic links to offering passwords after a while. I think others went down the same path but can’t recall specific names. It’s fun for a short while until it isn’t. Password reset flows are magic link for those who don’t want to remember their passwords.

Re: Why we went passwordless on our new product

#29

Post by bogwog »

onelovetwo wrote: post #18
bombcar wrote: post #10

Magic links are really REALLY annoying if cookies get removed often or if you don’t have access to email. Offer a password option, people! Back it up with a magic link if you must but offer a password! Especially if your magic links go to spam.

Its an even bigger friction for users, essentially I have to login to another service to login to yours.

True, but I think most people are signed in to at least one email account on their phone, so in the ideal case it's as easy as two clicks: 1 to open the email notification, and 1 to click the magic link.

I wonder if it could be securely done with the web notifications API, to make it 1 click?

Re: Why we went passwordless on our new product

#30

Post by reaperducer »

stickfigure wrote: post #13
kyriakos wrote: post #12

Email links mean I can't login from someone else's pc because I don't have my email setup on it. I find that very bad UX

In this day and age, you should not login to anything from someone else's PC.

In this day and age, you should not login to anything from someone else's PC.

There are a lot of occupations where you don't have your own computer, and share one with many other people.

For many jobs, the value is not in the person, but in the position, so the position has a single computer for a function that multiple people fill. Especially if you work for a company that operates 24/7.

For example, each person person operating a control computer at a recycling station does not have his own computer. There is a computer for each position, and who mans that position will change from day to day.

Freight dispatchers, retail sales, customer service, airline operations, and many broadcast positions are in the same boat.

Imagine how big an airline ticketing counter would have to be if "In this day and age, you should not login to anything from someone else's PC" was reality.

Post reply on HN