4 ms·

I dunno - I get the privacy concerns, sure. But passwordless requires the user have an email address to receive the nonce, and it requires the developer to deal

by pfooti 11y ago

I dunno - I get the privacy concerns, sure. But passwordless requires the user have an email address to receive the nonce, and it requires the developer to deal with that flow. It also requires transactional email, which can be laggy at times - I know sometimes (rarely, but not never) my mandrill outbounds can take minutes to actually resolve. If I'm sitting waiting for a login token to get to my emails and it's not Right There, I'm walking. I don't see passwordless fixing anything new that OAuth doesn't fix. Use the basic profile grant, and the user sees the consent screen where you're just asking for a small grant. Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche.

lootsauce 11y ago
Sure, lag could be a problem with some email providers, but you are not limited to email. From the site: "Deliver your tokens via email, text messages (SMS), or smoke signs. You can embed Sendgrid, emailjs, Twilio, or any other framework you like to get the token to your user."
callahad 11y ago
> Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche. You're making a flawed assumption that just because a major email provider offers OAuth, that websites themselves will also integrate with that OAuth provider. Yahoo Mail supports OAuth, but that's not worth a damn if sites don't explicitly integrate with Yahoo and provide a "Sign in with Yahoo" button. That's why we need email-based authentication. Because, in practice, sites are going to integrate with Gmail and Facebook and call it a day. (On the flipside, there's a great opportunity for Passwordless to offer optional, transparent integration with major OAuth providers, while falling back to an email loop for everyone else so people don't get locked out. That's what we did for Persona, and it mostly worked wonderfully.)
- aianus 11y ago
  > That's why we need email-based authentication. Because, in practice, sites are going to integrate with Gmail and Facebook and call it a day. So what? That covers like 95% of web users right there and if some users don't like it they can go through the full signup flow.
  - dreamfactory2 11y ago
    That's a very Western centred view. We really seem to be losing sight of the internet as a global shared infrastructure, which was the point of the whole thing and where the benefits have come from. On the present course we might as well be going back to the arid experiences of fido and minitel.
- pfooti 11y ago
  > You're making a flawed assumption that just because a major email provider offers OAuth, that websites themselves will also integrate with that OAuth provider. Yahoo Mail supports OAuth, but that's not worth a damn if sites don't explicitly integrate with Yahoo and provide a "Sign in with Yahoo" button. I'm not really sure I buy this premise. As a developer, it's my job to provide login options. I'm 100% on board with not providing a username / password option unless my bosses demand it and ignore my counterarguments. But I fail to see how the passwordless model is not just an equivalent case with using lots of OAuth2 plugins. It's a neat system, don't get me wrong. I could see using it in addition to a typical suite of OAuth providers. But I don't see it as a drop-in, solve-everything replacement for OAuth2. It's really just a (node / express) library that approaches the same problems but exposes different implementation issues instead.
josteink 11y ago
> Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche. Eh. Screw company emails eh?
- shaftway 11y ago
  https://accounts.google.com/SignUpWithoutGmail https://accounts.google.com/SignUpWithoutGmail

by pfooti 11y ago

lootsauce 11y ago

Sure, lag could be a problem with some email providers, but you are not limited to email. From the site: "Deliver your tokens via email, text messages (SMS), or smoke signs. You can embed Sendgrid, emailjs, Twilio, or any other framework you like to get the token to your user."

callahad 11y ago

> Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche. You're making a flawed assumption that just because a major email provider offers OAuth, that websites themselves will also integrate with that OAuth provider. Yahoo Mail supports OAuth, but that's not worth a damn if sites don't explicitly integrate with Yahoo and provide a "Sign in with Yahoo" button. That's why we need email-based authentication. Because, in practice, sites are going to integrate with Gmail and Facebook and call it a day. (On the flipside, there's a great opportunity for Passwordless to offer optional, transparent integration with major OAuth providers, while falling back to an email loop for everyone else so people don't get locked out. That's what we did for Persona, and it mostly worked wonderfully.)

aianus 11y ago
> That's why we need email-based authentication. Because, in practice, sites are going to integrate with Gmail and Facebook and call it a day. So what? That covers like 95% of web users right there and if some users don't like it they can go through the full signup flow.
- dreamfactory2 11y ago
  That's a very Western centred view. We really seem to be losing sight of the internet as a global shared infrastructure, which was the point of the whole thing and where the benefits have come from. On the present course we might as well be going back to the arid experiences of fido and minitel.
pfooti 11y ago
> You're making a flawed assumption that just because a major email provider offers OAuth, that websites themselves will also integrate with that OAuth provider. Yahoo Mail supports OAuth, but that's not worth a damn if sites don't explicitly integrate with Yahoo and provide a "Sign in with Yahoo" button. I'm not really sure I buy this premise. As a developer, it's my job to provide login options. I'm 100% on board with not providing a username / password option unless my bosses demand it and ignore my counterarguments. But I fail to see how the passwordless model is not just an equivalent case with using lots of OAuth2 plugins. It's a neat system, don't get me wrong. I could see using it in addition to a typical suite of OAuth providers. But I don't see it as a drop-in, solve-everything replacement for OAuth2. It's really just a (node / express) library that approaches the same problems but exposes different implementation issues instead.

josteink 11y ago

> Passwordless works for users whose email providers are not also major OAuth providers, which is nice, but also pretty niche. Eh. Screw company emails eh?

shaftway 11y ago
https://accounts.google.com/SignUpWithoutGmail https://accounts.google.com/SignUpWithoutGmail