5 ms·

When I started on my first project as a junior engineer I thought I was being clever to build an app without any passwords: every time you wanted to login you r

When I started on my first project as a junior engineer I thought I was being clever to build an app without any passwords: every time you wanted to login you received a new email with a link to log you in. Technically, this worked great but after a while I received many complaints from frustrated users who kept looking for the “signup form”…

webmobdev 4y ago
Amazon does this! Morons will ask you to "click the link in the sms" to "authorise access". I can understand doing this randomly once or twice, for security. But every single time!? Figured they were doing it for two reasons - data-mining (to figure out what mobile phone and mobile browser yo have, and to leave an Amazon cookie on your mobile browser), and to harass you into installing and using the Amazon app instead of the website. Had to call customer support multiple times before this stopped (who kept urging me to install the Amazon app).
smt88 4y ago
You can solve this problem without a signup form. Just give the user two links: sign up and log in. Both ask for email address first. The next screen tells them to check their email. You can use unusual flows without confusing users as long as you give them cues about how to do what they're trying to do.
- drawfloat 4y ago
  That doesn’t solve the issue of passwordless login, though, which is the fact not everyone has access to their email on every device at all times. Need to check something attached to a work email (hello Slack) but purposefully not got work email set up on your personal device? Good luck
  - solarkraft 4y ago
    It's not only having "access to your emails", sometimes these services will send links that are supposed to open in an app and do something there. ... and it just doesn't work.
  - Groxx 4y ago
    Want to log in on your TV? Ha. Good luck with that. Your email provider probably only supports Chrome.
  - smt88 4y ago
    > Need to check something attached to a work email (hello Slack) but purposefully not got work email set up on your personal device? This isn't worse or different than SSO, which your work should be enforcing anyway.
weird-eye-issue 4y ago
ImprovMX does this just fine
- cx42net 4y ago
  That's crazy! I was reading the article and kept in mind what we did in ImprovMX and was surprised to see we were mentioned in the comment :D We did, tried something "original" in the login part, by offering a "one time login link" to our users instead of the standard flow. To be honest, we believe this was a bad idea. The flow in itself is good and works fine (supposing email delivery works), but as @simonw perfectly said it, "resist the temptation to innovate around login!". Offering that original "one time login link" is a frequent cause of support request because some users doesn't receive it, doesn't know what to do or how. They are not used to a change on login and this causes more troubles down the road than a standard flow. That's why we later on decided to add the standard "password" login and tried to reverse that original flow. We still have users that have accounts with no password set though (still connecting via the original "one time login link").
- innocenat 4y ago
  ImprovMX was extremely confusing to me at first.
  - weird-eye-issue 4y ago
    Checking your email for the login link was confusing?
    - innocenat 4y ago
      Email I wanted to use as a login is a totally be a different email than what I wanted to forward to.
    - bombcar 4y ago
      I hate the email login link stuff, and any site that has it as the only option, I move on unless absolutely forced to use it. Especially a pain if I'm trying to login on a device without my email.
jcelerier 4y ago
Oh the few websites that do this drive me absolutely crazy. It makes me immediately look for alternatives, it's unbearable
- Avamander 4y ago
  Revolut does this for app logins and it's infuriating when your (new) phone doesn't have the email account used synchronized.
  - Zopieux 4y ago
    This so much. If some Revoluter reads HN comments, please raise the concern, this is such a PITA.
- jen729w 4y ago
  It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.
  - arubania2 4y ago
    You could consider setting up a separate email account just for the verification messages and have that on your phone.
    - zhfliz 4y ago
      can you name even one service that uses login links and allows you to configure an address that is exclusively used for login links and not any other communication? i'm not talking about unselecting all other types of communication, but rather having the service store 2 different emails for you. one for logging in and one for communication.
      - 4y ago
cognaitiv 4y ago
This is ostensibly what WebAuthn will do. It needs to happen, but retraining users is going to be the difficult bit.
fragmede 4y ago
It's a decent idea! Slack does this, as does a few other services.
switch007 4y ago
I love having my access denied while the email systems delay the email arriving in to my inbox
netheril96 4y ago
Email is not a secure method of communication.
- wizofaus 4y ago
  And yet it's surprising how many sites allow you to reset a password using nothing but an email link (single factor authentication - and there are already known cases of emails being silently redirected).
- rocqua 4y ago
  Email os how all password recovery flows work. So your accounts are generally as secure as your Email.
- b112 4y ago
  Nor is SMS. Nor a phone call (even a presumed "landline" can be voip, and that can be hacked too). Here's the truth ; nothing is "secure". Now... is email more secure than SMS, or less? What about other 2-factor auth things? Is email secure with 2-factor auth?

webmobdev 4y ago

Amazon does this! Morons will ask you to "click the link in the sms" to "authorise access". I can understand doing this randomly once or twice, for security. But every single time!? Figured they were doing it for two reasons - data-mining (to figure out what mobile phone and mobile browser yo have, and to leave an Amazon cookie on your mobile browser), and to harass you into installing and using the Amazon app instead of the website. Had to call customer support multiple times before this stopped (who kept urging me to install the Amazon app).

smt88 4y ago

You can solve this problem without a signup form. Just give the user two links: sign up and log in. Both ask for email address first. The next screen tells them to check their email. You can use unusual flows without confusing users as long as you give them cues about how to do what they're trying to do.

drawfloat 4y ago
That doesn’t solve the issue of passwordless login, though, which is the fact not everyone has access to their email on every device at all times. Need to check something attached to a work email (hello Slack) but purposefully not got work email set up on your personal device? Good luck
- solarkraft 4y ago
  It's not only having "access to your emails", sometimes these services will send links that are supposed to open in an app and do something there. ... and it just doesn't work.
- Groxx 4y ago
  Want to log in on your TV? Ha. Good luck with that. Your email provider probably only supports Chrome.
- smt88 4y ago
  > Need to check something attached to a work email (hello Slack) but purposefully not got work email set up on your personal device? This isn't worse or different than SSO, which your work should be enforcing anyway.

weird-eye-issue 4y ago

ImprovMX does this just fine

cx42net 4y ago
That's crazy! I was reading the article and kept in mind what we did in ImprovMX and was surprised to see we were mentioned in the comment :D We did, tried something "original" in the login part, by offering a "one time login link" to our users instead of the standard flow. To be honest, we believe this was a bad idea. The flow in itself is good and works fine (supposing email delivery works), but as @simonw perfectly said it, "resist the temptation to innovate around login!". Offering that original "one time login link" is a frequent cause of support request because some users doesn't receive it, doesn't know what to do or how. They are not used to a change on login and this causes more troubles down the road than a standard flow. That's why we later on decided to add the standard "password" login and tried to reverse that original flow. We still have users that have accounts with no password set though (still connecting via the original "one time login link").
innocenat 4y ago
ImprovMX was extremely confusing to me at first.
- weird-eye-issue 4y ago
  Checking your email for the login link was confusing?
  - innocenat 4y ago
    Email I wanted to use as a login is a totally be a different email than what I wanted to forward to.
  - bombcar 4y ago
    I hate the email login link stuff, and any site that has it as the only option, I move on unless absolutely forced to use it. Especially a pain if I'm trying to login on a device without my email.

jcelerier 4y ago

Oh the few websites that do this drive me absolutely crazy. It makes me immediately look for alternatives, it's unbearable

Avamander 4y ago
Revolut does this for app logins and it's infuriating when your (new) phone doesn't have the email account used synchronized.
- Zopieux 4y ago
  This so much. If some Revoluter reads HN comments, please raise the concern, this is such a PITA.
jen729w 4y ago
It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.
- arubania2 4y ago
  You could consider setting up a separate email account just for the verification messages and have that on your phone.
  - zhfliz 4y ago
    can you name even one service that uses login links and allows you to configure an address that is exclusively used for login links and not any other communication? i'm not talking about unselecting all other types of communication, but rather having the service store 2 different emails for you. one for logging in and one for communication.
    - 4y ago

cognaitiv 4y ago

This is ostensibly what WebAuthn will do. It needs to happen, but retraining users is going to be the difficult bit.

fragmede 4y ago

It's a decent idea! Slack does this, as does a few other services.

switch007 4y ago

I love having my access denied while the email systems delay the email arriving in to my inbox

netheril96 4y ago

Email is not a secure method of communication.

wizofaus 4y ago
And yet it's surprising how many sites allow you to reset a password using nothing but an email link (single factor authentication - and there are already known cases of emails being silently redirected).
rocqua 4y ago
Email os how all password recovery flows work. So your accounts are generally as secure as your Email.
b112 4y ago
Nor is SMS. Nor a phone call (even a presumed "landline" can be voip, and that can be hacked too). Here's the truth ; nothing is "secure". Now... is email more secure than SMS, or less? What about other 2-factor auth things? Is email secure with 2-factor auth?