4 ms·
1) you can hash together email + randomsalt + password and then store randomsalt and the hashed value 2) you avoid passwords altogether by giving a user an aut
by throwaway015089 6y ago
1) you can hash together email + randomsalt + password and then store randomsalt and the hashed value
2) you avoid passwords altogether by giving a user an authentication token to be saved as a bookmark perhaps? The token contains a cryptographic signature
- spartanatreyu 6y agoFor 1), How would password resets work? Wouldn't you need more than just their email? For 2), This sounds like a bad idea for anyone sharing their screen, they could broadcast the url or even just share a link not understanding how it works and lose control of their own account. Also this would only work for users who use bookmarks.
- throwaway015089 6y ago1) A new password is accepted using an email validation and the previous hash is replaced 2) The url with token is used only for logging in and the user is forwarded to the home, just like the email confirmation links in emails