What happens when multiple people use a device? Like iPad or family computer?
A bold but simple login system
31–40 of 101 posts
Re: A bold but simple login system
#32Someone needs a history of internet mail. It was never designed to operate in real time or be fast, whereas people expect logins to be fairly quick. Also, using an email backchannel and one time keys moves the security from an encrypted connection (assuming SSL) to an unencrypted SMTP connection anyone can view... Back in the good old days of UUCP you might wait a day or two to get mail from across the globe...
Who really cares what it was designed to do? The fact is, almost the entire userbase is going to receive that email before they can switch tabs to their email inbox. So even though it wasn't designed to be immediate, it is in practice, and we have a whole list of technologies that we use despite intent (HTTP wasn't designed to be stateful, and yet we use it as such constantly). Mail transmitting is only sometimes enc…
I have had to wait couple of minutes for the email show up in gmail or few minutes for it to be delivered to outlook.
Re: A bold but simple login system
#33OK, so i am going to go out on a limb here and assume that this WILL piss off a portion of your users.
That being said, can it work "halfway"? It seems the main benefit of this approach (from a UX standpoint, disregarding security etc.) would be to simplify things for people who always use one device and forget and reset their passwords all the time anyway.
What one could do is to simply reverse the prominence of the "enter password" and "reset password" steps of your login flow.
Enter your email, and get a big fat "Get Login Link" button below the field. Next to it is a small link that says "use password"
Re: A bold but simple login system
#34This would drive me up the wall. I don't want to have to sit in my mail client, waiting for it to pull down the message that may-or-may-not have arrived at my mail host yet, when it's incredibly easy to use a password manager for everything without having to leave my browser. He bemoans the number of controls you need to interact with to log in, but to get to log in with his method, I need to put in my email address…
I guessed that in "interact" he included "inspect and make sure you don't need to touch it".
Re: A bold but simple login system
#35Why accounts should have anything to do with email or email address. It's bad policy and I hate it. We all know that email isn't secure. For many sites I would like to disable password recovery due these inherit security issues related to email. If you ever login to Gmail, after that you have always clear all cookies and cache data and possible super cookies. After that you would need to login (again) to email to uh oh, access other sites. Afaik this is super bad idea. Naturally you could save the link as bookmark, which would work. But security would still suck.
Re: A bold but simple login system
#36I don't want people knowing what services I signed up for even if mainstream. Anytime you leak any user info you potentially weaken security.
Re: A bold but simple login system
#37For most cases, I think the ideal is identity tied to the device/browser via an email address: https://login.persona.org/
Exactly. As a developer I get back the email address of the user that has authenticated with the BrowserID server. That way it is easy to build a list of authorized users.
I suspect they will make a browser specific login workflow in which case you would not even need to be presented with a form asking you to auth as a user. Your browser would know your credentials already (which I guess is similar to login details autocomplete).
Re: A bold but simple login system
#38On OpenRent [1] we're using the Google Identity Toolkit [2]. We're finding that in our current configuration it works extremely well, even for non technical users.
It offers password-less log-in, and also remembers your username/email client-side. The only issue is lack of support for facebook/twitter log in out of the box - but that is apparently in development.
It doesn't seem to be widely adopted, and that is possibly due to the reliance on Google servers it adds to your service. Whether that comes back to haunt us or not I don't know - but I have a backup system in place in case GITKit does stop working!
Re: A bold but simple login system
#39This means the second someone loses access to their email account, they lose access to every account on every system attached to it via this method. I'm not sure introducing a single point of failure is a good idea.
Re: A bold but simple login system
#40Apple should augment a single sign-in mechanism with a transparent 2nd factor embodied in the iPhone. This would result in your being automatically logged into any participating site while using Safari on the same LAN as your iPhone. The mechanism would fall back to the traditional password if you don't have the phone. Bluetooth could also be used to communicate to the hardware.
The hardware would only run signed Apple firmware and be separated from the CPU and most of the rest of the device, except for access to radios.