3 ms·

I have a Yahoo Japan account and find this incredibly frustrating. Obviously they've measured it to be better on average, but if you already have a password man

I have a Yahoo Japan account and find this incredibly frustrating. Obviously they've measured it to be better on average, but if you already have a password manager, it's just an extra hurdle and waste of time when logging in. This effectively overrides all of the improvements in password managers, especially OS-level ones, in recent years. On iOS, for example, the system suggests a strong password on account creation and then autofills very quickly and easily both on the web and in apps, so it's secure and you never have to think about it. But now with this change, you don't even have that option and you always have to wait for the email, open your email, click the link to go back to the app/site, and then go back and delete the email.

neither_color 4y ago
I'm not a fan of anything that takes me off the page I'm looking at or screen. I find it disruptive enough that I'll forget I'm logging in when I tab over to check my email and start reading some other message because the subject got my attention, especially if Ive been waiting half a minute for my "magic link." I also don't want to wade through notifications on my phone to check my authenticator or SMS. Ever since apple implemented auto password AND authenticator fill in with face/touch ID logging in has felt natural and frictionless again.
- 8organicbits 4y ago
  I saw a great pattern for this recently. The login page examines your email address to guess what web-based email you're using. It then crafts a link that takes you right to the search page, with a "from:login-noreply@example.com age:1h" search. This way, the user just clicks a link and if the email is delivered quickly, they see only that message. Although I agree with others, just let my password manager auto-complete, I don't want to load my email.
apatters 4y ago
The reason I'm still a bit skeptical about password-less authentication is because the cost savings opportunity is enormous. So enormous that it would be easy to lose sight of everything else. About a third of Yahoo Japan's customer support requests where password inquiries -- the FIDO Alliance estimates the cost of a single password reset inquiry at $70. It's hard to look at those numbers as a manager with bottom line responsibility and not want to go full password-less. But as a startup your main interest should usually be growth, cost reduction is best addressed after you hit a critical mass. It feels like the jury is still out on whether password-less converts better -- this article says it does, but doesn't go into depth. Anecdotally it seems to frustrate a lot of people (me included). Password-less may be great, I just know that in enterprise the support cost savings are going to distort or render all other arguments moot. We have a long history of ideas that have come out of FAANG, worked well for them, and been cargo-culted into the rest of the world where they promptly turned out to be a bad choice.
- adhesive_wombat 4y ago
  You can reduce password inquiries too by losing all your customers. It would be very Yahoo of them to lose thousands of customers and then promote the culprit because they reported that password request metrics got a lot better! Not that I think that happened, but if it had to be any company that did that, they're a candidate.

neither_color 4y ago

I'm not a fan of anything that takes me off the page I'm looking at or screen. I find it disruptive enough that I'll forget I'm logging in when I tab over to check my email and start reading some other message because the subject got my attention, especially if Ive been waiting half a minute for my "magic link." I also don't want to wade through notifications on my phone to check my authenticator or SMS. Ever since apple implemented auto password AND authenticator fill in with face/touch ID logging in has felt natural and frictionless again.

8organicbits 4y ago
I saw a great pattern for this recently. The login page examines your email address to guess what web-based email you're using. It then crafts a link that takes you right to the search page, with a "from:login-noreply@example.com age:1h" search. This way, the user just clicks a link and if the email is delivered quickly, they see only that message. Although I agree with others, just let my password manager auto-complete, I don't want to load my email.

apatters 4y ago

The reason I'm still a bit skeptical about password-less authentication is because the cost savings opportunity is enormous. So enormous that it would be easy to lose sight of everything else. About a third of Yahoo Japan's customer support requests where password inquiries -- the FIDO Alliance estimates the cost of a single password reset inquiry at $70. It's hard to look at those numbers as a manager with bottom line responsibility and not want to go full password-less. But as a startup your main interest should usually be growth, cost reduction is best addressed after you hit a critical mass. It feels like the jury is still out on whether password-less converts better -- this article says it does, but doesn't go into depth. Anecdotally it seems to frustrate a lot of people (me included). Password-less may be great, I just know that in enterprise the support cost savings are going to distort or render all other arguments moot. We have a long history of ideas that have come out of FAANG, worked well for them, and been cargo-culted into the rest of the world where they promptly turned out to be a bad choice.

adhesive_wombat 4y ago
You can reduce password inquiries too by losing all your customers. It would be very Yahoo of them to lose thousands of customers and then promote the culprit because they reported that password request metrics got a lot better! Not that I think that happened, but if it had to be any company that did that, they're a candidate.