7 ms·
Fast – One-click sign up, login and checkout
- lucideer 7y agoSeems I need to sign in to find out what the product is. Great.
- degenerate 7y ago"Our mobile app is coming to iOS and Android devices with all new amazing features." If your entire business centers around "one click"... then what features would that app even have?
- 0xCMP 7y agoYou could imagine it'd be easier/nicer for the App to get the request instead of sending the email and simply click on a notification which does an auto-login. Also being able to manage your logins and account via an App instead of their website which is always appreciated.
- degenerate 7y agoGood points. They should mention what's planned.
- sergiomattei 7y agoFeatures don't matter: the value proposition does, and if it solves a pain for a customer, it's a winner.
- jamesgeck0 7y agoIs this a 100% proprietary authentication protocol? I'd say something snarky, but I'm still bitter about Mozilla Persona.
- giancarlostoro 7y agoMozilla Persona was on GitHub all along was it not? Not sure what the issue with that one was. https://github.com/mozilla/persona https://github.com/mozilla/persona
- jszymborski 7y ago> # Self-hosting Persona > This approach is not recommended most reliers. Persona has a large and complex codebase that has not seen significant development in several years, and Mozilla will not provide security or maintenance updates after 30th November 2016. https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers https://wiki.mozilla.org/Identity/Persona_Shutdown_Guideline... Doesn't seem like a very good option for people today...
- giancarlostoro 7y agoI know today it is abandoned, but I'm wondering about when it was actively developed.
- jamesgeck0 7y agoIt was a federated system. The idea was more or less that your email provider would host an instance of Persona, and if you were logged into webmail you could be logged in anywhere with a click or two. But nobody used it. No email providers, no websites. You could fall back to Mozilla's Persona instance to try it out, but the user experience was not amazing. It kinda fizzled out. https://wiki.mozilla.org/Identity/Persona_AAR https://wiki.mozilla.org/Identity/Persona_AAR
- Dirlewanger 7y agoYeah these closed-platform protocols can take a hike. Zero interest. Stop trying to build a business around the needless reinvention of the wheel.
- athenot 7y agoIt looks like a single-sign on (SSO) Identity Provider that's backed by just your email address. It's not the worst idea, especially for low risk stuff. I'm not sure I'd use it for ecommerce though.
- 0xCMP 7y agoEven for high risk stuff probably as long as your Email is actually treated as important to secure (e.g. Security Keys and etc.)
- navs 7y agoI don’t see why you wouldn’t use it for e-commerce. Are you worried about CC numbers? Assuming Apple Pay, Stripe the CC is tokenised on the e-commerce store’s end.
- antihero 7y agoMonzo do this for your actual bank account. Basically it relies on your email being secure. If your email isn't secure, you're fucked anyway.
- jtth 7y agoThis could be a parody site for the SSO movement of the early 2010s.
- vorpalhex 7y agoSo if this is free, and they're paying to send emails.. how are they making money?
- AyKarsi 7y agoprobably a cut of the order amount when you use their checkout.
- throw03172019 7y agoVCs are paying for it :)
- turc1656 7y agoPaying to send emails? I assume you mean something like Twilio? For a company providing this type of service, I would imagine they would have written the core code themselves and email is pretty basic/simple to send (stuff like texting is much more complicated). I would be shocked if they actually just plugged in something like Twilio to farm out their core service.
- vorpalhex 7y agoWhether they pay for a bulk sending service or host a mail server and keep a few engineers, they're still paying.
- timon-io 7y agoGiven the amount of people I've seen using 'forgot-password'-feature every time to log in, I wonder why 'email-as-identity-provider' isn't used more ofter. Especially for 'casual' sites you use rarely. Any idea, other than maybe phishing?
- yule 7y agoI assume other than phishing it's also the poor UX of switching to your email inbox and then back to the browser, which can be especially bad on mobile. That being said, I like the idea and have asked myself that question before as well.
- 0xCMP 7y agoAnd yet many people are already doing that because of two-factor security codes many services use to make sure it's you.
- 333c 7y agoDoesn't Medium do this?
- spurgu 7y agoYou can do this for logging into Slack IIRC (might be mobile only?).
- jsjohnst 7y agoSlack’s magic link works on mobile and desktop.
- nefitty 7y agoIf you mean login through email link, firebase auth provides a very easy implementation of it.
- highwind 7y agoMozilla tried that once and failed. I really miss it. https://en.wikipedia.org/wiki/Mozilla_Persona https://en.wikipedia.org/wiki/Mozilla_Persona
- greggman2 7y agoI don't like frictionless sign up. It leads to anti-patterns like Google's "Sign in With Google" that appears 1-5 seconds after the page loads and with zero confirmation means it's trivial to click by accident. The moment you do your email is shared with the site you're on.
- X6S1x6Okd1st 7y agoAny other antipatterns? Because that one doesn't seem to apply here.
- eps 7y ago> We’re not saying we’re famous, but.. [Product Hunt] I don't know how to put it mildly, but ... jeez, lol. PH ranking doesn't correlate much with the quality of the products. All this says is that you managed to score some Internet points on a site popular in the SV echo chamber and that you think it's worthy a mention.
- mk89 7y agoFrom the context they come this is quite something, I would say. It's a start up that made it to the front page of HN, product hunt, etc... :)
- bborud 7y agoI use the video conferencing site https://whereby.com https://whereby.com and they have used a very similar scheme for quite a while now.
- mk89 7y agoI am wondering what makes them different from... Let's say passwordless Auth0...
- skrebbel 7y agoI like that they incorporated under "Fast AF, Inc".
- treebornfrog 7y agoThis looks like a fast acquisition target.
- deleted 7y ago[deleted]
- turc1656 7y agoI assume this idea behind this is to expedite the login and checkout process? If so, I don't see how it would actually be faster or easier. It's simple and easy for me to just grab the password from my password manager. I absolutely do not want to have to log in or check my email to log into a site unless it has something to do with 2FA - and even then I prefer an authenticator app.
- thrownaway954 7y agoyou are not like most people. most people don't use a password manager, nor will they ever. Most use an excel file and have them written down somewhere... So when they are confronted with a login, and they don't remember the password, they either just leave or attempt to retrieve it or go through the mundane take of using the a dismal password retrieval process.
- marcell 7y agoI'm not sure this is true anymore. Chrome and mobile browsers have built in password managers that automatically sync across your devices.
- thrownaway954 7y agoalmost everyone i know has the remember password feature disabled because: a) they don't want their passwords going Google. b) it's annoying when you saved the wrong one by mistake and now it auto-fills it every time. c) there is no reason to use one since they only use a bank of 5 or less passwords across all their accounts.
- thrownaway954 7y agoi really want to know how this works.
- iamben 7y agoPre smartphones I would have hated this, but I'd argue it's probably easier on mobile than desktop now, so probably quite useful. 99% of everyone I know has email pop up. You'd just click the pop up and click the button in the email (I assume). Raises an interesting attribution problem when Gmail opens it in its own browser though... Unless the email is passing stuff as tracking, those ecom sales are gonna be hard to track...
- rsweeney21 7y agoI've spent some time playing around with it and it seems like this particular implementation is unsafe. Scenario: 1. I enter my email address on the sign in screen on Fast.co in Tab A. 2. I get an email with a "Login" button in it in Tab B. 3. I click the "Login" button and it opens Tab C and tells me I'm now logged in in Tab A. 4. I go back to Tab A and I'm logged in. Here's the problem: A hacker sitting next to me see's me type my email in to Fast.co or some site that uses Fast login. They type my email in too. I get two emails with Login buttons. How do I know which one logs me in and which one logs in the hacker? If I click the wrong one, the hacker gets a cookie on their machine that gives them access to my account for 30 days.
- ryanwaggoner 7y agoHopefully the link has to be opened on the browser that initiated the original login request.
- rsweeney21 7y agoIt does not. I was able to start the login process on my desktop, click "Login" in the email sent to my phone, and it logged me in on my desktop.
- shrew 7y agoJust tried the same and then entered my email again from another browser shortly after, as you suggested. The first sign in link expired but if your email client displays threaded messages you could very easily click the second and think nothing of it. That would allow the attacker in straight away, while also allowing your original browser in with a bit of faff. There's an active session list, but presumably most users wouldn't be looking at that. Certainly made me more sceptical as I was otherwise quite interested!
- miccah 7y agoPerhaps an identifier can be used so the user can quickly verify the email matches the page. It could be something like a sequence of 3 emojis because matching numbers is hard.
- adyus 7y agoThis is essentially a souped-up https://portier.github.io/ https://portier.github.io/ I applaud the initiative, since it removes the couple steps it takes a user to reset their password via "Forgot password" flows. However, this type of auth should really be self-hosted or baked into the most popular frameworks, instead of provided by (yet) another third party you'd have to trust with your users' email address (at the very least).