4 ms·
i'm using this approach for a project (for a customer) where they don't want their users sharing their login details (username/password) with others. so it's a
by mjl- 6y ago
i'm using this approach for a project (for a customer) where they don't want their users sharing their login details (username/password) with others. so it's a way to keep some control over who is accessing the system. the assumption is that people won't share credentials for their mailbox with others.
email is still mostly sent as plain text over the internet, that's certainly a downside.
email delays haven't been a problem in practice for us.
we also send users notification emails with links going directly to the right page, automatically logging the user in. i would like that from other services as well, as i'm browsing with ephemeral browser containers. having a clean browser environment triggers some website (eg github) to verify my login with a unique code sent by email. that indicates email delays aren't a showstopper in practice at big scale either.
- tatersolid 6y ago> email is still mostly sent as plain text over the internet, that's certainly a downside. Opportunistic TLS for SMTP seems to have been dominant on the US portion of the internet for nearly a decade. Especially as email is concentrated in a few huge providers who have been using STARTTLS for many years. I say this based on the systems and logs I have monitored in that same timeframe. In fact, many email systems (mostly corporate MS Exchange) appear to be configured to reject or spam-bucket email connections that don’t support STARTTLS with a public CA certificate. (This observation may be biased by covering the financial services industry more than others.)