3 ms·

Question: When you implement this, at what point (if any) do you have a user create a password?

• thaumasiotes 8y ago
  There are companies so freaked out by the idea of leaking user passwords that they just don't use any auth method other than a link sent to the user's email address. A couple major considerations if you're using that approach: - When do those links expire? - Do you keep logs of the pages that people request from your server? An unexpired link compromises the user just as much as a password leak would have, since those links _are_ the user passwords. But server logs generally aren't tied down as tightly as a more obviously sensitive password database would be. The nightmare scenario here is "every time the user needs to log in, we generate a new password for them, and every password stays valid forever. Whenever anyone actually does log in, we record their password in our server logs, available at www.ourcompany.com/debug/ . Then we send it to a dozen different third-party analytics providers."
  • ravenstine 8y ago
    Ideally, you'd want those links to expire after one use or after a few minutes, and you'd have some means of preventing replay-attacks. (a temporary token stored on the client that gets sent to the server during the email dispatch) Assuming every channel is encrypted, an unexpired link isn't as easily compromised as a password.