A bold but simple login system • Hacker News Board

Re: A bold but simple login system

#51

Post by MatthewPhillips » Sun, Jul 29, 2012, 5:34 PM UTC

swah wrote: post #27

MatthewPhillips wrote: post #9

This is how Staticloud[1] works. You put in your email address and receive a log in link. You never have to register; registration and login are the same process. [1] http://staticloud.com/

Very interesting idea! Although I'm not sure that it would actually make it easier for users that don't do tabbed navigation (mom) to log from a second/public computer. So, if elegant for power users, and 'not easier' for mom-users, should we implement it?

I agree that the UX isn't perfect, but neither is our current login/password system for every site. For me personally, if I don't use a site regularly my login process turns into: click forgot password link, check my email, reset the password, then login. Then again the next time I visit the site 3 months later. So if that's what we're going up against, the email to login session flow isn't too bad.

Re: A bold but simple login system

#52

Post by agscala » Sun, Jul 29, 2012, 5:37 PM UTC

So going from a "bad" login form with 6 controls to a "simpler" login where I now have to interact with the site's form, my browser, and my email client is somehow better?

This is just silly and a login form like this would drive me crazy

Re: A bold but simple login system

#53

Post by bluesnowmonkey » Sun, Jul 29, 2012, 5:44 PM UTC

jsmcallister wrote: post #13

I had to read this article twice to make sure I was understanding it right. I honestly see zero benefit in this approach. It does not speed up the login process at all. The only thing it accomplishes is not requiring the user to remember a password. Additionally, it puts way too much power in the hands of random email servers. What if my email system at the office goes down for a few hours. Am I locked out of all web…

You only get locked out of a website if you delete your cookies while your email provider is down. How often does that happen?

This idea doesn't speed up the login process, but it accomplishes a few other useful things. The server doesn't store passwords, so a breach of the server doesn't compromise other services for which users had duplicate passwords. And users can't compromise their own accounts by choosing weak passwords. Both scenarios are commonplace.

Re: A bold but simple login system

#54

Post by IceCreamYou » Sun, Jul 29, 2012, 5:49 PM UTC

I actually implemented a system very much like this on an internal company network recently. For that purpose, it worked great. I don't think it would work in an open, public context, not least because an attacker can force your site to spam its users. However, when you are going to stay logged in forever on basically the same devices, having an email-based login system without a password is no more pain for the user than a verification email (since that's all you're doing anyway). Essentially you're relying on the website to generate a local, device-specific, secure password instead of requiring the user to create and remember a (likely insecure) password themselves.

Re: A bold but simple login system

#55

Post by fooooobar » Sun, Jul 29, 2012, 5:52 PM UTC

MatthewPhillips wrote: post #9

This is how Staticloud[1] works. You put in your email address and receive a log in link. You never have to register; registration and login are the same process. [1] http://staticloud.com/

How does this work if I have multiple computers? Do I have to register with each device and have a different account for each device?

Re: A bold but simple login system

#56

Post by Johngibb » Sun, Jul 29, 2012, 5:53 PM UTC

I definitely find this topic interesting and have a hard time remembering all my passwords, but I'm not fan of this solution. Honestly, how isn't this just a worse implementation of OAuth? It seems equivalent to clicking a "login via gmail" button, except with more of a lag?

Re: A bold but simple login system

#57

Post by kleim » Sun, Jul 29, 2012, 5:54 PM UTC

zdw wrote: post #20

ef4 wrote: post #11

Please, somebody figure out how to get us over the hump to the bright future day when we all have asymmetric keys embedded in hardware and we can leave passwords behind.

Please, somebody figure out that when you embed asymmetric keys in things, when people lose those things they'll get really angry or Please, somebody figure out that when you embed asymmetric keys in people's bodies, we'll end up with a lot of geeks with their hands hacked off with machetes.

"Hacker" would have a really different meaning then...

Re: A bold but simple login system

#58

Post by sturadnidge » Sun, Jul 29, 2012, 5:57 PM UTC

I honestly don't understand a lot of the comments in here. For starters, many websites (eg Twitter) require email confirmation for new signups and password resets. This is not so different, the UX related commentary is superficial at best. After the initial activation / a reset you're back to cookie based auth, just like most sites.

Second, there is not a single mention of the biggest problem with passwords currently: the apparent inability of many sites to store them securely. I'll take this method of authentication over a password based one any day for probably 90% of the sites I have an account with currently. Especially sites like HN (not implying insecure password storage on HN - just saying for any forum based sites, it's more than adequate IMHO).

Re: A bold but simple login system

#59

Post by stcredzero » Sun, Jul 29, 2012, 6:03 PM UTC

leviathan wrote: post #45

stcredzero wrote: post #40

Apple should augment a single sign-in mechanism with a transparent 2nd factor embodied in the iPhone. This would result in your being automatically logged into any participating site while using Safari on the same LAN as your iPhone. The mechanism would fall back to the traditional password if you don't have the phone. Bluetooth could also be used to communicate to the hardware. The hardware would only run signed App…

so how does it differentiate between me and my wife, on the same network?

In this scheme, you and your wife would have different phones. You might still have to put in your user name to the browser once at the start of the session, or log out your wife.

Re: A bold but simple login system

#60

Post by pbreit » Sun, Jul 29, 2012, 6:04 PM UTC

rogerbinns wrote: post #50

pbreit wrote: post #23

The problem with "solutions" like these is that they start with faulty premise that "passwords are broken". This particular idea sounds like death by a million cuts.

Read this article from a few years ago http://www.uie.com/articles/three_hund_million_button/ It is titled "The $300 million button" and details actual user experience at an ecommerce site. Note how many users even know what email address they used, how many got the password right, daily password resets etc.

That article indicts registering to purchase and has almost nothing to do with the password topic in question. Can you imagine having to wait for a login email every time you tried to make a purchase? Ugh!!