6 ms·

A disadvantage is the media break while using passwordless. Some folks i met strongly believe that using a different medium while interacting with a site distr

by jand 11y ago

A disadvantage is the media break while using passwordless. Some folks i met strongly believe that using a different medium while interacting with a site distracts new users, by this lowering the sign-up rate. I have no data on that but it sounded at least plausible. If you believe in this, it would depend on your target group how you should handle passwords (or the lack of).

miseg 11y ago
If you can catch a person's email address upon their registration, it's the re-logging-in that would require them to switch to a different medium.
felipesabino 11y ago
I think your argument would also valid for 2FA approach, which is is widely encouraged regardless. Sign-up rate would drop drastically for a majority of common users if a good UX is not into play while developing the system workflow. But I want also say that for a great variety of solutions having 2FA or passwordless as default is valid, Slack for example has an option of demanding 2FA for all team members, which a lot of people would agree is a good thing. The "Password Security Guide" section at the article is a good example of educating people how insecure storing password, and you could do the same thing showing/enabling passwordless as a clear and easy alternative to migrate to.
- jand 11y ago
  You are right. Here comes the "target group" aspect (and some others) into play. Oversimplification: Are you targeting techies or eldery? Some will endure security-related hardships, others won't. As said, there is the need to watch who you design for.
- cvburgess 11y ago
  But most sites let you "trust this device" once you've done 2FA - passwordless doesn't have that option from what I can tell. Also, 2FA is an extra, optional layer for most users. They can choose if they want the extra hassle in exchange for security. Passwordless gives you no such option, you have to switch apps, period.

by jand 11y ago

miseg 11y ago

If you can catch a person's email address upon their registration, it's the re-logging-in that would require them to switch to a different medium.

felipesabino 11y ago

I think your argument would also valid for 2FA approach, which is is widely encouraged regardless. Sign-up rate would drop drastically for a majority of common users if a good UX is not into play while developing the system workflow. But I want also say that for a great variety of solutions having 2FA or passwordless as default is valid, Slack for example has an option of demanding 2FA for all team members, which a lot of people would agree is a good thing. The "Password Security Guide" section at the article is a good example of educating people how insecure storing password, and you could do the same thing showing/enabling passwordless as a clear and easy alternative to migrate to.

jand 11y ago
You are right. Here comes the "target group" aspect (and some others) into play. Oversimplification: Are you targeting techies or eldery? Some will endure security-related hardships, others won't. As said, there is the need to watch who you design for.
cvburgess 11y ago
But most sites let you "trust this device" once you've done 2FA - passwordless doesn't have that option from what I can tell. Also, 2FA is an extra, optional layer for most users. They can choose if they want the extra hassle in exchange for security. Passwordless gives you no such option, you have to switch apps, period.