3 ms·
Just set a never-expiring authentication cookie in the browser, so they never need to enter the password in typical one-device use. When they need to change de
by devit 8y ago
Just set a never-expiring authentication cookie in the browser, so they never need to enter the password in typical one-device use.
When they need to change devices, have the standard e-mail based password reset as well as "show password" in the account settings (make the password reset not reset login, unless the user explicitly elects to "log me out on all devices").
- thecatspaw 8y ago> show password You should not be able to do that if you're doing security properly. If you can show the password it means you're not hashing it properly and instead storing it as plaintext
- devit 8y ago1. You can store it on the client side in a cookie. 2. You can encrypt the passwords with a key outside of the database instead of hashing them. That means that people can now login with a read-only compromise of both your app and the database, but chances are that such a compromise would be a full compromise anyway. 3. You can also not show them the current password, but instead generate another one and have them both be valid (until explicitly revoked)
- TheDong 8y agoIf you're doing that, you might as well do the "magic email" link as medium does now (and as mozilla's now-defunct 'persona' did [0]). In that case, you don't have any passwords at all, merely long-lived tokens which the user mints by using a unique one-time nonce in an email link. To login on a new device, they get an email and click a link, and that's it. No passwords ever. [0]: https://developer.mozilla.org/en-US/docs/Archive/Mozilla/Persona https://developer.mozilla.org/en-US/docs/Archive/Mozilla/Per...