41–50 of 76 posts
One big flaw with login links sent to email is the delivery problem. You can't assume the email will be delivered so quickly. Who wants to get locked out of their account because the email has not arrived? Login links can be a convenience feature but they must not be the only mechanism for login.
1. Enter email
2. If the hidden password field autocompletes, use it
3. If not, send a magic link email that doubles as “someone is trying login” notification AND show the password field
So at this point you covered:
- people with password managers
- people who remember passwords
- people who don’t remember passwords
I delete cookies regularly and would find this incredibly annoying.
NOPE. Magic Links are dieing. This is probably the 20th time I've seen a start-up posting proudly about how they chose magic links over standard auth and I don't think any of them have stuck.
It is a TERRIBLE user experience.
* We have a tab open on your site, it tells us to go to our e-mail to get a link, and then that opens up a different tab.
* Or we only check that address on phone which means we can't easily login on desktop unless we also have that e-mail address logged in on desktop as well.
* It removes our ability to use password managers.
* Doesn't allow us to have multiple e-mail addresses easily. Now I have to remember what e-mail address I used for your service to go find the magic link.
STOP doing it. Give people two-factor authentication. Give people options if you want and see if anyone opts into magic links.
All that being said... It looks like this service does require password for sign-up and login right now unless you use google auth? Not sure how this blog post relates to the actual company. Maybe its something they are thinking about doing?
Earlier quoted context omitted.
In this day and age, you should not login to anything from someone else's PC. There are a lot of occupations where you don't have your own computer, and share one with many other people. For many jobs, the value is not in the person, but in the position, so the position has a single computer for a function that multiple people fill. Especially if you work for a company that operates 24/7. For example, each person per…
In that scenario, do you have individual accounts on the computer or are you all using a single login and sharing it? The first scenario is fairly secure, the latter is a nightmare.
I've never worked for an airline, so I can't say what happens in that specific scenario.
However, when I worked for a chemical company, printing out the hazardous materials labels for sample drums that were shipped all over the country, the computer had a single common login for all users.
I don't see how that is a nightmare.
1. wait for the email to arrive
2. click on the link
3. navigate back to my inbox
4. delete the email
5. navigate back to the app/website
(this is my inefficient way of doing it, I just don't like to have emails lying around that I don't need anymore)
> All this work just for the auth, which is not your core product and not what users come to you for.
What is part of my core product, if it's not something as basic as the authentication? I dislike the idea to outsource every tiny bit of a solution, especially if it's something I better keep control of.
Email was never meant as a means for synchronous communication, so stop pretending it is!
One big flaw with login links sent to email is the delivery problem. You can't assume the email will be delivered so quickly. Who wants to get locked out of their account because the email has not arrived? Login links can be a convenience feature but they must not be the only mechanism for login.
The trade off is higher security vs sites with passwords or an reset email option.
Earlier quoted context omitted.
Email links are a great password system on a "mobile first web". Not so much if you are using a desktop.. How so? I only have one service that I use which employs magic links, and I use it on a desktop with no problems. I'm starting an internal project for my company which will utilize magic links. About 50% of the users are expected to be on desktop, and 50% on iPads, so I'd like to know what the problem is for desk…
While on a mobile I have a gmail app (always logged in), on the desktop (browser) I don't store cookies so I'm rarely logged in. Typing a password with 2-step verification to follow a magic link is not optimal.