3 ms·
I've been wondering how even having a password at all might be an antiquated feature. Most sites/applications today require you to have an email address (wheth
by BerislavLopac 8y ago
I've been wondering how even having a password at all might be an antiquated feature.
Most sites/applications today require you to have an email address (whether alongside a username or, increasingly, as the only identifier), and fully pass all verification to your email provider (by providing a password reset). In that situation, having a separate password for that site (and, presumably, one for each new one) seems a bit superfluous -- it should be enough to, instead, just enter your email and receive a unique one-time URL that will log you in if opened within, say, 15 minutes.
Would this system be any more insecure than the present model of email + password + reset link?
- hjanssen 8y agoTumblr already gives you the choice to login via password or via a link sent to your inbox, although i have to admit i have only used this once to try it out - i am simply used to my password manager filling out the form in one click and i dont like to switch to my e-mail program everytime i log into something.
- sopooneo 8y agoIf you play this idea out to its extreme, and automate most of it, you get the first version of OAuth. https://support.smartbear.com/readyapi/docs/_images/projects/requests/auth/types/oauth1/about-flow.png https://support.smartbear.com/readyapi/docs/_images/projects...
- PretzelFisch 8y agoHow would you get that to work simply in a mobile app login flow?
- andreareina 8y agoIIRC, slack does (or did, ~3 years ago) exactly that. Either the email link is structured to cause the mobile OS to open the app, or the link leads to a page that then presents a link that opens in the app. In either case the link(s) contain a token that's valid for one use.