4 ms·
For services that generally "stay logged in", why have passwords at all? Just do "magic login link" emails, with some sort of 2FA if you're into that.
by trevyn 9y ago
For services that generally "stay logged in", why have passwords at all? Just do "magic login link" emails, with some sort of 2FA if you're into that.
- zootm 9y agoIsn't the former what Mozilla Persona was trying to provide? A shame that was canned.
- onli 9y agoWe built a successor project under https://portier.github.io/ https://portier.github.io/. Alive and kicking :)
- ryan-c 9y agoI think "magic login links" are fine for most services. Doing 2FA with that is not feasible though, unless you want to argue that receiving the email counts as "something you know" or that "something you have plus something else you have" counts as 2FA.
- trevyn 9y agoIf you have your email protected with 2FA, I think you're covered -- "An unlocked device with an active session" is the thing you have. I think this is actually what's happened -- people now know not to leave unlocked devices unattended, so you basically do 2FA every time you unlock your device, so the device can now stay persistently logged into all services.
- tmnvix 9y agoI've considered using "magic login link" emails but greylisting[1] seems to be an insurmountable problem. [1] https://en.wikipedia.org/wiki/Greylisting https://en.wikipedia.org/wiki/Greylisting
- ryan-c 9y agoGenerally greylisting is supposed to let future emails through once it establishes that a server will re-send. It should be possible to detect greylisting and warn the user. "Your email provider temporarily rejected our email to you. We will retry in a few minutes. If this happens persistently, please (check our guide for your provider, $MAJOR_PROVIDER|contact your provider) to figure out how to whitelist our login emails"