3 ms·
> I'm not saying that there aren't low-security services where this convenience is good. It's more that the author hasn't taken into account that there is great
by sssparkkk 15y ago
> I'm not saying that there aren't low-security services where this convenience is good. It's more that the author hasn't taken into account that there is greater security in the forgot password system.
Exactly. And I think it's somewhat dangerous for the author of the article to not understand this important distinction and at the same time advise creators of web apps to implement this behavior.
Judging by the amount of upvotes for the article and the comments it has been getting, I'm afraid some of us will simply follow his advice and replace reset password emails with direct login links.
- scoot 15y agoIt's getting upvotes because the title says "don't do this". People are voting for the fact that the article is offers bad advice. The author however doesn't seem to have quite grasped this - thanking us for his position on the HN front page!
- trotsky 15y agoNo, the main article has the same title. The author seems to mean: "don't make me log in after I click on an email!". It is clearly bad advice but HN often seems to vote on confidence of delivery.
- skrish 15y agoI upvoted it for the value of discussion in the thread than for the article itself. :)