3 ms·
Edit: This is a decent enough solution, though it comes with its own pitfalls. How exactly are you sure that the email is encrypted and is read only by the int
by newscracker 9y ago
Edit: This is a decent enough solution, though it comes with its own pitfalls.
How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else? This is too simplistic as a solution. Things like what to do if a user clicks on the same link more than once also have to be considered (is it really the intended user who clicked it or a malicious actor that the user is not aware of?).
- mehrdadn 9y ago> How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else? Same way you make sure that the password reset links sent to your email are only received by you and not by anyone else?
- jakecopp 9y agoThis! It's like everyone has already implemented email based login (password resets) but chooses more complexity by adding a password. I wish every site did this. Especially for non technical users, passwords are such a mental barrier.
- MildlySerious 9y agoAnother big one is that this method is not entirely device agnostic. I am not able/willing to log into my email account on every device that I might want to log into your service with. One way this has been prevented for me so far is to include a one time pass in the mail along with the link, but some people might still not have a second device on hand every time they want to log in.
- adambrenecki 9y agonow.sh handles this quite nicely: when you log in there, they send you an email and display three random words. When you get the email, you verify the words match, click the link, and then you'll be logged in in the original browser tab, on the original device.