4 ms·
You can also go password-less. Sessions are started with a URL sent to email. The session only begins if the cookie + signed URL match.
by tjkrusinski 7y ago
You can also go password-less. Sessions are started with a URL sent to email. The session only begins if the cookie + signed URL match.
- halfmatthalfcat 7y agoI reallllly wanted to do this in the beginning because it's so simple. However I think I came to the conclusion that forcing people to go in and out of their mail client every time they wanted to login was too much of a barrier, however I'd be easily convinced if people thought it was a better and more viable way to handle login.
- stephenr 7y agoThis is a ridiculously bad idea that’s been debunked as insecure and worse for usability dozens of times. Requiring a webcam and signing in by recognising interpretive dance would be a less crap idea.
- flashm 7y agoDebunked how? It seems the consensus is that it’s just as secure as using a username and password and allowing the user to reset via email. It’s been discussed here a few times.
- stephenr 7y agoYou have zero control over how their email is handled - and you're providing a way to login, no questions asked, with just access to their email. The usual "argument" about email resets is irrelevant - a password reset (a) doesn't have to be fully automated, (b) doesn't grant invisible access to an attacker (c) should leave an obvious audit trail
- kevinsimper 7y agoIt would be a good idea, most websites you don't need a password to login anyway, you just need to uze the password-reset form each time!