10 ms·

For my little side project I’m using email only. Tangentially related, I quite like Medium’s workflow where you don’t need to enter passwords anymore. You just

For my little side project I’m using email only. Tangentially related, I quite like Medium’s workflow where you don’t need to enter passwords anymore. You just enter your address, they send a login email, you click the link in your email, and it redirects you to Medium, logged in.

Xeoncross 9y ago
Interesting, I always assumed this would be too much hassle for users since after the first login, the browser (mobile or desktop) would remember the password. Certainly seems like an optimum solution to typing a password on first login though (assuming the email is prompt).
- davnicwil 9y ago
  Couple of points, first of all the thing the browser can still remember is the auth token in a non-expiring cookie. As the majority of users will rarely if ever clear cookies or change browsers, this nullifies the password remembering feature. Secondly, particularly on mobile, tapping through to email and hitting a link is probably faster and more convenient for most users than simply entering a password on the keyboard. It's just a shame it's such a pain to write automated tests that go through the email login procedure compared to username/password ;-)
  - oddlyaromatic 9y ago
    I used a fundraising tool recently with this kind of passwordless workflow. It's a tool that you only use once a year for about 30 days, and your authenticated session can last about that long. Which means you do the process once on each computer you use, and then you never have to remember the password the next year. It's great.
- deleted 9y ago
  [deleted]
jehlakj 9y ago
I like it too. No need for confirmation as you’re already accessing your email to login. It’s far more secure as the average user will most likely use the same password as the email to sign up with.
rocqua 9y ago
For real critical cases, I think a major issue might be plaintext SMTP.
- davewasthere 9y ago
  I don't know percentages, but it does seem like most major SMTP servers support opportunistic TLS, so your messages are at least encrypted over the wire.
a_imho 9y ago
You don't need to enter passwords because you are stuck in a password reset groundhog day scenario. You want to login to Medium yet you need to access your emails first, it makes very little sense actually.
- hellofunk 9y ago
  > it makes very little sense actually It's actually one of the safest ways to offer email authentication.
  - syrrim 9y ago
    Recall that the email requires some way to login, which is probably a password anyway. What do you gain in terms of security (rather than simplicity) by shifting responsibility onto the email provider?
    - hellofunk 9y ago
      Most email providers already implement (and with very large user bases which provide testing) all the features you'd have to implement yourself for proper security, like 2fa, password encryption, password reset workflows. To implement all that yourself, highly likely you will not do it as robustly as another provider. Also very costly in time.
swlkr 9y ago
I’m working on a side project that does this too, thought I was the only one. Whenever I see a regular user of any other service have to reset their password to login in anyway, I’m like man this password thing is kind of not that useful
deleted 9y ago
[deleted]
11235813213455 9y ago
it's like https://zeit.co/login https://zeit.co/login you get an email for each login
nkkollaw 9y ago
> Tangentially related, I quite like Medium’s workflow where you don’t need to enter passwords anymore. You just enter your address, they send a login email, you click the link in your email, and it redirects you to Medium, logged in. That's absolutely crazy, I've always thought it didn't make any sense. Browsers have autofill, and even if you don't want to use it it takes a lot less time to type your password than to click on a button, open your email client, wait for the email to arrive, click on a link, be taken back to the browser, yack! It only make _kind_ of sense on mobile where typing is harder, but then again it's also a pain to switch to email and back.
- hellofunk 9y ago
  Think about it from the perspective of the site owner. Much safer to offer access this way, and easier, than having to manage and store and secure passwords. Much safer for users.
  - nkkollaw 9y ago
    I'm not convinced. For the site owner, they can even more easily pick social login. As for safety, it's just as hard for a hacker to guess my email password then my website password, what is the difference? Not to mention that if my phone is around you might be able to see the URL from the lock screen, and if God forbid my phone (or even laptop, but it never happens) is unlocked my email client is accessible at all times without a password).
    - hellofunk 9y ago
      But if someone can access your email, they can already reset your password anyway. So email is the Golden Gate to your services in general, regardless of whether you use this approach. And the URLs that are sent out would not just be simple things that you could look at and remember and then go type them into some other computer. It comes down to ultimate safety for users and development time for vendors. I personally feel much safer knowing that some startup is not having to provide security on their own and store and manage my password and control all the things that my email provider does anyway. Because if that startup is hacked, there's much less likelihood of hackers walking away with credentials they can use later to access my account. Social sign on offers similar reliability and development benefits. The difference is that in my experience a lot of people are quite hesitant to use a social service like facebook to sign onto a site that otherwise contains important personal data. But I do typically work with customers who are older, so they're less likely to understand these kinds of practices. A very common misconception that I've heard many many times is people who think that because you login with a Gmail or a Facebook OAuth, that means you're giving those companies access to your account on our app. Seems silly, but a very common misconception.

Xeoncross 9y ago

Interesting, I always assumed this would be too much hassle for users since after the first login, the browser (mobile or desktop) would remember the password. Certainly seems like an optimum solution to typing a password on first login though (assuming the email is prompt).

davnicwil 9y ago
Couple of points, first of all the thing the browser can still remember is the auth token in a non-expiring cookie. As the majority of users will rarely if ever clear cookies or change browsers, this nullifies the password remembering feature. Secondly, particularly on mobile, tapping through to email and hitting a link is probably faster and more convenient for most users than simply entering a password on the keyboard. It's just a shame it's such a pain to write automated tests that go through the email login procedure compared to username/password ;-)
- oddlyaromatic 9y ago
  I used a fundraising tool recently with this kind of passwordless workflow. It's a tool that you only use once a year for about 30 days, and your authenticated session can last about that long. Which means you do the process once on each computer you use, and then you never have to remember the password the next year. It's great.
deleted 9y ago
[deleted]

jehlakj 9y ago

I like it too. No need for confirmation as you’re already accessing your email to login. It’s far more secure as the average user will most likely use the same password as the email to sign up with.

rocqua 9y ago

For real critical cases, I think a major issue might be plaintext SMTP.

davewasthere 9y ago
I don't know percentages, but it does seem like most major SMTP servers support opportunistic TLS, so your messages are at least encrypted over the wire.

a_imho 9y ago

You don't need to enter passwords because you are stuck in a password reset groundhog day scenario. You want to login to Medium yet you need to access your emails first, it makes very little sense actually.

hellofunk 9y ago
> it makes very little sense actually It's actually one of the safest ways to offer email authentication.
- syrrim 9y ago
  Recall that the email requires some way to login, which is probably a password anyway. What do you gain in terms of security (rather than simplicity) by shifting responsibility onto the email provider?
  - hellofunk 9y ago
    Most email providers already implement (and with very large user bases which provide testing) all the features you'd have to implement yourself for proper security, like 2fa, password encryption, password reset workflows. To implement all that yourself, highly likely you will not do it as robustly as another provider. Also very costly in time.

swlkr 9y ago

I’m working on a side project that does this too, thought I was the only one. Whenever I see a regular user of any other service have to reset their password to login in anyway, I’m like man this password thing is kind of not that useful

deleted 9y ago

[deleted]

11235813213455 9y ago

it's like https://zeit.co/login https://zeit.co/login you get an email for each login

nkkollaw 9y ago

> Tangentially related, I quite like Medium’s workflow where you don’t need to enter passwords anymore. You just enter your address, they send a login email, you click the link in your email, and it redirects you to Medium, logged in. That's absolutely crazy, I've always thought it didn't make any sense. Browsers have autofill, and even if you don't want to use it it takes a lot less time to type your password than to click on a button, open your email client, wait for the email to arrive, click on a link, be taken back to the browser, yack! It only make _kind_ of sense on mobile where typing is harder, but then again it's also a pain to switch to email and back.

hellofunk 9y ago
Think about it from the perspective of the site owner. Much safer to offer access this way, and easier, than having to manage and store and secure passwords. Much safer for users.
- nkkollaw 9y ago
  I'm not convinced. For the site owner, they can even more easily pick social login. As for safety, it's just as hard for a hacker to guess my email password then my website password, what is the difference? Not to mention that if my phone is around you might be able to see the URL from the lock screen, and if God forbid my phone (or even laptop, but it never happens) is unlocked my email client is accessible at all times without a password).
  - hellofunk 9y ago
    But if someone can access your email, they can already reset your password anyway. So email is the Golden Gate to your services in general, regardless of whether you use this approach. And the URLs that are sent out would not just be simple things that you could look at and remember and then go type them into some other computer. It comes down to ultimate safety for users and development time for vendors. I personally feel much safer knowing that some startup is not having to provide security on their own and store and manage my password and control all the things that my email provider does anyway. Because if that startup is hacked, there's much less likelihood of hackers walking away with credentials they can use later to access my account. Social sign on offers similar reliability and development benefits. The difference is that in my experience a lot of people are quite hesitant to use a social service like facebook to sign onto a site that otherwise contains important personal data. But I do typically work with customers who are older, so they're less likely to understand these kinds of practices. A very common misconception that I've heard many many times is people who think that because you login with a Gmail or a Facebook OAuth, that means you're giving those companies access to your account on our app. Seems silly, but a very common misconception.