4 ms·

Why do we have passwords? I mean, ok, I know why, but he mentioned he's just going to enter random gibberish and then use the recover password links when he ne

by Ogre 16y ago

Why do we have passwords? I mean, ok, I know why, but he mentioned he's just going to enter random gibberish and then use the recover password links when he needs to log in to sites again. Why don't any sites, as an option, cut out the middleman and just have an "email me a login link"? No need to save a password at all, just a good for a single login link and the usual session tracking.

lukeschlather 16y ago
Email is not universally reliable enough for that to be practical. If you leave browsers logged in, it might be a little more so, but still, I want to log in now. Not in a half an hour after the email works its way through my company's spam filters.
- arethuza 16y ago
  If your emails take 30 minutes to arrive then there is something seriously wrong somewhere.
  - bensummers 16y ago
    Or the server uses greylisting as part of their spam prevention mechanisms.
  - lukeschlather 16y ago
    I guarantee a considerable fraction of your users are using mail servers that have something seriously wrong somewhere.
ryanwaggoner 16y ago
You'd still need a password for your email...
- Ogre 16y ago
  Sure, it's clearly not a good idea for every site. But for things people treat as throwaway already (like gawker logins), why not? It doesn't seem like it's any less secure than things are now, especially if, as the author proposes, you're going to purposefully not remember your passwords and always use the recovery links.
nodata 16y ago
If we're going to do away with passwords, let's at least do it properly with smartcards.
- pdx 16y ago
  Who wants to carry a smartcard everywhere?
  - bensummers 16y ago
    Who wants to carry their housekeys everywhere?
    - pdx 16y ago
      Certainly not me. I had to tie it to my shoelace when I was going for a run, as my running shorts don't have pockets. Now, of course, as technology has caught up, I bought a lock from Home Depot that allows me to just remember a combination and not use house keys. Much nicer.
- arethuza 16y ago
  I've worked with systems that used USB tokens with X509 certificates for authentication and the tokens still required a password (as with Chip-n-Pin cards). The "something you have" only really works as an additional authentication factor to the "something you know" of the passwords.
  - nodata 16y ago
    (I didn't say smartcards don't need passwords..)
pdx 16y ago
I like this idea. You wouldn't even need to make it only work for a single login. Let it live for a year or forever. Automate the bookmark procedure for them as well, so their bookmark for your site (https, of course) would automatically log them in, as it would contain a very large random string that identifies them. For extra points on sensitive sites, tie that random string to their IP address, so it only works from the IP address they were at when they first clicked it. If they click it from a new IP address, an email is sent, asking permission to whitelist that IP address for them as well.
crocowhile 16y ago
You don't store passwords on your inbox, do you? The reason is that if someone has access to your email, then you are screwed. Same applies with what this guy is proposing: I find your email password, I change it and you are screwed.
- Ogre 16y ago
  But sites that provide an "I forgot my password" already have this vulnerability if they don't ask for any further information to recover your password. Many sites don't. If someone has access to your email, you're already just as screwed. Sites that do ask for extra info (Mother's maiden name type of thing) are protected against this, but there are an awful lot of sites that never ask you for anything but an email address and a password when signing up.
  - crocowhile 16y ago
    Those are the sites who are not doing their job properly and there's no reason to adapt to their solution. Getting rid of passwords tout-court may seem convenient but it's really bad for security.
deleted 16y ago
[deleted]
Jencha 16y ago
It's called OpenID. However it won't send you a link, but will just ask you to press "Yes, Log in" button.
brlewis 16y ago
Be careful when you ask "Why don't any sites...". At least one site does have this option: http://ourdoings.com/ http://ourdoings.com/

by Ogre 16y ago

lukeschlather 16y ago

Email is not universally reliable enough for that to be practical. If you leave browsers logged in, it might be a little more so, but still, I want to log in now. Not in a half an hour after the email works its way through my company's spam filters.

arethuza 16y ago
If your emails take 30 minutes to arrive then there is something seriously wrong somewhere.
- bensummers 16y ago
  Or the server uses greylisting as part of their spam prevention mechanisms.
- lukeschlather 16y ago
  I guarantee a considerable fraction of your users are using mail servers that have something seriously wrong somewhere.

ryanwaggoner 16y ago

You'd still need a password for your email...

Ogre 16y ago
Sure, it's clearly not a good idea for every site. But for things people treat as throwaway already (like gawker logins), why not? It doesn't seem like it's any less secure than things are now, especially if, as the author proposes, you're going to purposefully not remember your passwords and always use the recovery links.

nodata 16y ago

If we're going to do away with passwords, let's at least do it properly with smartcards.

pdx 16y ago
Who wants to carry a smartcard everywhere?
- bensummers 16y ago
  Who wants to carry their housekeys everywhere?
  - pdx 16y ago
    Certainly not me. I had to tie it to my shoelace when I was going for a run, as my running shorts don't have pockets. Now, of course, as technology has caught up, I bought a lock from Home Depot that allows me to just remember a combination and not use house keys. Much nicer.
arethuza 16y ago
I've worked with systems that used USB tokens with X509 certificates for authentication and the tokens still required a password (as with Chip-n-Pin cards). The "something you have" only really works as an additional authentication factor to the "something you know" of the passwords.
- nodata 16y ago
  (I didn't say smartcards don't need passwords..)

pdx 16y ago

I like this idea. You wouldn't even need to make it only work for a single login. Let it live for a year or forever. Automate the bookmark procedure for them as well, so their bookmark for your site (https, of course) would automatically log them in, as it would contain a very large random string that identifies them. For extra points on sensitive sites, tie that random string to their IP address, so it only works from the IP address they were at when they first clicked it. If they click it from a new IP address, an email is sent, asking permission to whitelist that IP address for them as well.

crocowhile 16y ago

You don't store passwords on your inbox, do you? The reason is that if someone has access to your email, then you are screwed. Same applies with what this guy is proposing: I find your email password, I change it and you are screwed.

Ogre 16y ago
But sites that provide an "I forgot my password" already have this vulnerability if they don't ask for any further information to recover your password. Many sites don't. If someone has access to your email, you're already just as screwed. Sites that do ask for extra info (Mother's maiden name type of thing) are protected against this, but there are an awful lot of sites that never ask you for anything but an email address and a password when signing up.
- crocowhile 16y ago
  Those are the sites who are not doing their job properly and there's no reason to adapt to their solution. Getting rid of passwords tout-court may seem convenient but it's really bad for security.

deleted 16y ago

[deleted]

Jencha 16y ago

It's called OpenID. However it won't send you a link, but will just ask you to press "Yes, Log in" button.

brlewis 16y ago

Be careful when you ask "Why don't any sites...". At least one site does have this option: http://ourdoings.com/ http://ourdoings.com/