3 ms·
There is a whole line of thought that accounts should be passwordless and accessed via an email reset link as part of normal login procedure.
by sam_lowry_ 5y ago
There is a whole line of thought that accounts should be passwordless and accessed via an email reset link as part of normal login procedure.
- slavboj 5y agoWhich is great until you lose access to your email.
- em-bee 5y agoif you loose access to your email, you may just be out of luck. a good service will not allow you to change your registered email address without verifying that you own the old one
- yawaramin 5y agoNot in my experience. Every account I can think of allows me to change my email address without verifying the old one.
- dstick 5y agoAnd how would you even login to your email using that method :)
- jedberg 5y agoYeah I hate that method. It's good in theory but terrible for the user. I go to a website I want to use. I click the magic link. The email takes 10 seconds to show up. In that 10 seconds I find something else to do while I'm waiting. I get distracted and find the magic link in my email 10 minutes later. It's now expired and I have to start over. Or just give up. With a password, I click the site I want to use, my password manager fills in the password for me, and I click "login" and bam, I'm done.
- zimpenfish 5y ago> The email takes 10 seconds to show up. Even longer if you have greylisting turned on, it gets temporarily rejected which means you then have to wait N minutes before it gets accepted (assuming they retry sensibly and don't just spam retries every 2 minutes and get fail2ban'd.) By which time it might well have timed out anyway...
- OJFord 5y agoA faulty line that's miserable UX and barely better security, but sure, a line.