Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A bold but simple login system

notes.xoxco.com

Post reply on HN
Print view View original

41–50 of 101 posts

Re: A bold but simple login system

#41

Post by Nav_Panel »

crcsmnky wrote: post #26

What's the overlap of users who (a) have trouble with login forms and (b) leave their email open all the time (whether browser or dedicated app)? This relies on a very high level of comfort with email and context switching. This could potentially introduce an increase in spam if users are now instructed to click on links in emails blindly as long as they match a site that they're familiar with. Leaving one app/tab fo…

This seems more ideal for mobile devices. Enter name -> email notification almost immediately and use that to log in. I personally think it would be easier and faster than attempting to enter a password using the on-screen keyboard.

Re: A bold but simple login system

#42

Post by lbotos »

Spoom wrote: post #39

This means the second someone loses access to their email account, they lose access to every account on every system attached to it via this method. I'm not sure introducing a single point of failure is a good idea.

While True, isn't browserID piggybacking on this? Using your email as the "persona"? An accidental benefit would be any service that implanted this would be automatically two-factored for users who have a two-factor system enabled. I like the thought of that.

Re: A bold but simple login system

#43

Post by stcredzero »

andos wrote: post #25
ef4 wrote: post #11

Please, somebody figure out how to get us over the hump to the bright future day when we all have asymmetric keys embedded in hardware and we can leave passwords behind.

Tada! http://en.wikipedia.org/wiki/Security_token Guess what? Even worse usability.

I suspect the usability problems could be solved.

Re: A bold but simple login system

#44

Post by zerovox »

Spoom wrote: post #39

This means the second someone loses access to their email account, they lose access to every account on every system attached to it via this method. I'm not sure introducing a single point of failure is a good idea.

This is true already for pretty much every website that lets you recover password by email, and most allow this. Any that use a secret question wouldn't switch to this scheme anyway. It reduces the hassle, as if your email got compromised, and they change passwords to all your other accounts, you have to regain access one by one, changing passwords back and so on, when with this email system, you can just regain access to the email account and the rest are under your control again.

Re: A bold but simple login system

#45

Post by leviathan »

stcredzero wrote: post #40

Apple should augment a single sign-in mechanism with a transparent 2nd factor embodied in the iPhone. This would result in your being automatically logged into any participating site while using Safari on the same LAN as your iPhone. The mechanism would fall back to the traditional password if you don't have the phone. Bluetooth could also be used to communicate to the hardware. The hardware would only run signed App…

so how does it differentiate between me and my wife, on the same network?

Re: A bold but simple login system

#46

Post by empire29 »

At a very high level, I like this idea. It would be great if there was browser support to super-persist the auth tokens (cookies) through cookie-clearing and also sync between browsers on machines -- most likely via a browser plugin.

Re: A bold but simple login system

#47

Post by UntitledNo4 »

lgbr wrote: post #30
zdw wrote: post #8

Someone needs a history of internet mail. It was never designed to operate in real time or be fast, whereas people expect logins to be fairly quick. Also, using an email backchannel and one time keys moves the security from an encrypted connection (assuming SSL) to an unencrypted SMTP connection anyone can view... Back in the good old days of UUCP you might wait a day or two to get mail from across the globe...

Who really cares what it was designed to do? The fact is, almost the entire userbase is going to receive that email before they can switch tabs to their email inbox. So even though it wasn't designed to be immediate, it is in practice, and we have a whole list of technologies that we use despite intent (HTTP wasn't designed to be stateful, and yet we use it as such constantly). Mail transmitting is only sometimes enc…

And I recently had to wait about two weeks to get an email from Channel 4 (UK TV channel) to confirm my email...

Re: A bold but simple login system

#48

Post by jobu »

haldean wrote: post #2

This would drive me up the wall. I don't want to have to sit in my mail client, waiting for it to pull down the message that may-or-may-not have arrived at my mail host yet, when it's incredibly easy to use a password manager for everything without having to leave my browser. He bemoans the number of controls you need to interact with to log in, but to get to log in with his method, I need to put in my email address…

The idea here is you only need to log in on a device once (or as often as you delete all your cookies). After that the site would remember you, so there really wouldn't be that much waiting on emails to arrive.

Definitely not something I would want for my bank account, but who cares for logging on to a support forum or some other trivial account.

Re: A bold but simple login system

#50

Post by rogerbinns »

pbreit wrote: post #23

The problem with "solutions" like these is that they start with faulty premise that "passwords are broken". This particular idea sounds like death by a million cuts.

Read this article from a few years ago http://www.uie.com/articles/three_hund_million_button/

It is titled "The $300 million button" and details actual user experience at an ecommerce site. Note how many users even know what email address they used, how many got the password right, daily password resets etc.

Post reply on HN