4 ms·
It only has to be as secure as password reset. Passwordless login is just password reset without a password, neatly removing the weak link in the chain.
by jdashg 8y ago
It only has to be as secure as password reset.
Passwordless login is just password reset without a password, neatly removing the weak link in the chain.
- truesy 8y agoExactly. You can have a rock-solid password login system, but pretty much everyone has a reset feature which kicks a link to the email address, and allows that user to change the password. It's no less secure than that.
- DDub 8y agoIt is slightly less secure than that as the password reset form has a notification mechanism built into it in that the next time you login you realise that you need to reset the password back to what you control, where the magic link does not have such a mechanism to let you know that a compromise has taken place. It is slight, and requires you to be paying attention.
- hndamien 8y agoBut you may still get notifications of requests for the link that you don't request.
- pbhjpbhj 8y agoI don't think it's that slight a difference - password reset is akin to a door that you have to break open. The reset is obvious, there's evidence. A password-less login, the email can be deleted and unless there are logs of last login, and the user notes the pertinent detail, then the intrusion can be covert. Having someone unknowingly have a key to your apartment is much more of a breech than discovering a broken lock that you know needs fixing.
- deleted 8y ago[deleted]
- jlgaddis 8y ago> Passwordless login is just password reset without a password .... And without the security questions.
- blattimwind 8y agoMost sites don't have those anyway. I think the biggest security differential is the fact that a compromised password reset generally is harder to hide, because the attacker cannot replicate the original token.
- Sohcahtoa82 8y agoSecurity questions are often worthless anyways, especially if the victim is active on Facebook.