4 ms·

Does anyone have any experience with password-less login? Like were you just do the other half of a 2fa like an email? And I mean both experience as a consumer

Does anyone have any experience with password-less login? Like were you just do the other half of a 2fa like an email? And I mean both experience as a consumer or developer. I feel like if I were to make a service that required log in that's how I would do it, but with all the talking about it I've never actually seen it in the wild.

jamil7 6y ago
I believe notion used to do something similar with one time passwords but they seemed to have dropped that.
flak48 6y ago
Firebase offers email login (passwordless) as an auth method. Where you are emailed a new URL that logs you in, each time you wish to. It also offers SMS based login in a similar manner where no passwords are involved and you just copy a 6 digit or so number from a SMS you receive upon clicking 'Login' In India this SMS based login method without passwords is the norm for almost all locally developed apps I've used (despite SMS as the sole authentication factor being not really secure due to the possibility of sim swapping, etc). Disney Plus (Hotstar) in India has recently started mandating users to switch to such SMS based single factor auth (from password based login), presumably to add friction for account sharers.
mercer 6y ago
Do you mean stuff like Medium's 'magic link' approach? enter email address, get a link via email, click on link: magically logged in! If so, that's exactly what I've discussed with various clients to implement for their projects, because I agree that in many cases it's a really nice and, as far as I can tell, safe approach. Personally I really don't like it, because I have a password manager and I rarely have my email open in my browser. But for many, if not most 'casual' computer users it does seem ideal to me.
Macha 6y ago
It feels like a great way to lose users in the login process. They try to log in, go to their email, get distracted by a facebook/whatever login. Even as a user, it's more friction than a social login or password manager. This is effectively what I needed to do when I used vatsim prior to using a password manager as they made you use a password set by the app that was 8 characters alphanumeric so I used to end up having to reset it a lot.
ldjb 6y ago
Monzo Bank here in the UK does that. Your account doesn't have a password. Instead, when you want to log in, it sends you an email with a link that expires after a certain amount of time.
uallo 6y ago
I use it in a side project. Reasons: * B2B. The project is targeting companies where everyone relies on email. * It is easier to implement. Compared to normal email/password-based authentication systems, it is almost exactly like the email verification step but it does not need any "forgot password" or "change password" functionality. * Access tokens are temporary. If your DB ever gets hacked, the tokens are not valuable in the long run. * Makes account reusing by multiple people more complicated. This is especially useful when your project uses seat-based pricing. * Cheap "SSO". You can only use the service as long as you have access to the email address. This might be interesting for companies. People who leave automatically lose access (as soon as the token expires).
msh 6y ago
As a user it's a pain. I might not want to sign in with my email on the phone or computer that I am trying to use some unrelated service on.
jackewiehose 6y ago
Discord is using user/password but every time I want to log in it says my IP-adress has changed and I have to use my email to verify my location. So it's basically the same as password-less email-login. That's terribly annoying to me as a consumer so please don't do it.
- Can_Not 6y ago
  I lost a discord account by forgetting to change my email address when sunsetting a domain then getting a new phone.
Kolians 6y ago
Microsoft uses password-less login across its services (like Outlook, Windows/MS Store, etc). I can still use my password if I absolutely want/have to, but once I enter my email, my Microsoft authenticator app on my phone prompts me for approval. Once I've given it, the site (or app or whatever) lets me in without having to enter the password. I really like it and sort of wish more sites did this.

jamil7 6y ago

I believe notion used to do something similar with one time passwords but they seemed to have dropped that.

flak48 6y ago

Firebase offers email login (passwordless) as an auth method. Where you are emailed a new URL that logs you in, each time you wish to. It also offers SMS based login in a similar manner where no passwords are involved and you just copy a 6 digit or so number from a SMS you receive upon clicking 'Login' In India this SMS based login method without passwords is the norm for almost all locally developed apps I've used (despite SMS as the sole authentication factor being not really secure due to the possibility of sim swapping, etc). Disney Plus (Hotstar) in India has recently started mandating users to switch to such SMS based single factor auth (from password based login), presumably to add friction for account sharers.

mercer 6y ago

Do you mean stuff like Medium's 'magic link' approach? enter email address, get a link via email, click on link: magically logged in! If so, that's exactly what I've discussed with various clients to implement for their projects, because I agree that in many cases it's a really nice and, as far as I can tell, safe approach. Personally I really don't like it, because I have a password manager and I rarely have my email open in my browser. But for many, if not most 'casual' computer users it does seem ideal to me.

Macha 6y ago

It feels like a great way to lose users in the login process. They try to log in, go to their email, get distracted by a facebook/whatever login. Even as a user, it's more friction than a social login or password manager. This is effectively what I needed to do when I used vatsim prior to using a password manager as they made you use a password set by the app that was 8 characters alphanumeric so I used to end up having to reset it a lot.

ldjb 6y ago

Monzo Bank here in the UK does that. Your account doesn't have a password. Instead, when you want to log in, it sends you an email with a link that expires after a certain amount of time.

uallo 6y ago

I use it in a side project. Reasons: * B2B. The project is targeting companies where everyone relies on email. * It is easier to implement. Compared to normal email/password-based authentication systems, it is almost exactly like the email verification step but it does not need any "forgot password" or "change password" functionality. * Access tokens are temporary. If your DB ever gets hacked, the tokens are not valuable in the long run. * Makes account reusing by multiple people more complicated. This is especially useful when your project uses seat-based pricing. * Cheap "SSO". You can only use the service as long as you have access to the email address. This might be interesting for companies. People who leave automatically lose access (as soon as the token expires).

msh 6y ago

As a user it's a pain. I might not want to sign in with my email on the phone or computer that I am trying to use some unrelated service on.

jackewiehose 6y ago

Discord is using user/password but every time I want to log in it says my IP-adress has changed and I have to use my email to verify my location. So it's basically the same as password-less email-login. That's terribly annoying to me as a consumer so please don't do it.

Can_Not 6y ago
I lost a discord account by forgetting to change my email address when sunsetting a domain then getting a new phone.

Kolians 6y ago

Microsoft uses password-less login across its services (like Outlook, Windows/MS Store, etc). I can still use my password if I absolutely want/have to, but once I enter my email, my Microsoft authenticator app on my phone prompts me for approval. Once I've given it, the site (or app or whatever) lets me in without having to enter the password. I really like it and sort of wish more sites did this.