Magic links suck. I just want to use my password manager and not login to email first to login to your service after that. Medium for example uses magic links too and it's so annoying.
Why we went passwordless on our new product
61–70 of 76 posts
Re: Why we went passwordless on our new product
#62"we didnt want to implement full blown password login..."
Checking if a password matches seems a lot easier than 1)generate a code 2) send an email with the code 3) have an endpoint the verifies the code 4) find the websocket connection associated with the code 5) send a websocket frame with the access token for the use to authenticate future requests
Re: Why we went passwordless on our new product
#63Earlier quoted context omitted.
I think you're being downvoted because you deliberately choose to introduce a layer of complexity into your life, then complain when something is complex.
A layer of privacy shouldn't be downvoted or considered complexity. If someone chooses to not be tracked that is not something to look down on. If you care about privacy, you'll pick flows that all your users to maintain their privacy.
If you care about privacy, you'll pick flows that all your users to maintain their privacy.
As stated, my project is an internal company project and will be entirely on company-owned hardware, so I don't care about my user's privacy in this case.
Re: Why we went passwordless on our new product
#64"Passwords are dying" NOPE. Magic Links are dieing. This is probably the 20th time I've seen a start-up posting proudly about how they chose magic links over standard auth and I don't think any of them have stuck. It is a TERRIBLE user experience. * We have a tab open on your site, it tells us to go to our e-mail to get a link, and then that opens up a different tab. * Or we only check that address on phone which mea…
Totally agree. I advise all of my clients away from "password less" because it's a terrible UX.
I recently moved all of my email forwarding away from ImprovMX and a big reason was the obnoxious passwordless system. There are a few others I've bailed on as well for the same reason.
Re: Why we went passwordless on our new product
#65Wow. Who are these people’s customers? I can’t think of a single enterprise company (or really any company using SSO to manage their applications) that would find this acceptable. It would be instantly dead in the water for my small IT department.
Re: Why we went passwordless on our new product
#66Earlier quoted context omitted.
Security requires good governance and trust - and ultimately realizing that everything connected online can and will likely be breached - and so if something is important enough, the design should be that it never touches the network. I personally don't fear any of my history or life coming out if it were - at least at this point, and in reality if security becomes a real concern due to well, tyranny and the universa…
> Security requires good governance and trust Neither of which the web currently has.
Arguably true.
Re: Why we went passwordless on our new product
#67If widely adopted, then a compromised e-mail could lead to much deeper access than a single compromised password would (except for those who use the same pw everwhere). I understand the motivation, and agree re: the issues of passwords, though.
Could you explain why? Is it because a log-in request essentially looks exactly the same as a "forgot password" request and is likely to slip under the radar of someone monitoring for suspicious activity?
If you use N sites which all adopt this authentication mechanism (i.e. widespread adoption); and if I can access your e-mail, then I can access all of those N sites. Furthermore, yes, because all those accesses look normal, nobody would detect it as unauthorized.
Re: Why we went passwordless on our new product
#68Earlier quoted context omitted.
Its an even bigger friction for users, essentially I have to login to another service to login to yours.
Maybe they should offer a mobile app that works like microsoft and google where you get a notification and you click approve or deny on the phone. Basically, use traditional 2fa as the only factor instead of the second factor.
Another app is worse than another website.
Re: Why we went passwordless on our new product
#69Earlier quoted context omitted.
True, but I think most people are signed in to at least one email account on their phone, so in the ideal case it's as easy as two clicks: 1 to open the email notification, and 1 to click the magic link. I wonder if it could be securely done with the web notifications API, to make it 1 click?
Click on the service you want to log into, wait 30 seconds-10 minutes for email to arrive, THEN click on email and click on magic link.
And end up clicking on it on the wrong device and now you’re logged in on your phone instead of the desktop.
Re: Why we went passwordless on our new product
#70Earlier quoted context omitted.
I had to google "~=" had no idea some languages use that for "not equals" instead of !=. I've only found lua and MATLAB that use it but its interesting to understand. I was super confused on what you were trying to say.
I thought he meant "about equal" as I've always used tilde to me about/approximately.
Maybe he can clarify. I don't want to assume he meant "not equals" but thats what I found on google