12 ms·

Oh the few websites that do this drive me absolutely crazy. It makes me immediately look for alternatives, it's unbearable

Avamander 4y ago
Revolut does this for app logins and it's infuriating when your (new) phone doesn't have the email account used synchronized.
- Zopieux 4y ago
  This so much. If some Revoluter reads HN comments, please raise the concern, this is such a PITA.
jen729w 4y ago
It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.
- arubania2 4y ago
  You could consider setting up a separate email account just for the verification messages and have that on your phone.
  - zhfliz 4y ago
    can you name even one service that uses login links and allows you to configure an address that is exclusively used for login links and not any other communication? i'm not talking about unselecting all other types of communication, but rather having the service store 2 different emails for you. one for logging in and one for communication.
    - arubania2 4y ago
      That is a fair point, indeed this would probably make the configuration page extremely complex. I guess my suggestion would only work for cases where you don’t really care much about other kinds of notifications.
  - deleted 4y ago
    [deleted]
  - ThePowerOfFuet 4y ago
    What a pain. Nope.
  - blowski 4y ago
    Why should I have to go through all that faff when I have a perfectly good password manager?
    - arinlen 4y ago
      > Why should I have to go through all that faff when I have a perfectly good password manager? If you are not using dedicated special-purpose email addresses with specific services, you're already grossly mismanaging your online safety. Think about it for a second: how does your password manager help you if your email password gets leaked?
      - maccard 4y ago
        Thats a crazy level of risk assessment for an average user. > how does your password manager help you if your email password gets leaked? You still need my TOTP codes in my case at least, which conveniently are stored in my password manager. Is it perfectly secure? No, of course it's not, but frankly my risk profile isn't worrying about a targeted attack on me and my password manager, it's worrying about leaked shared credentials. Side note, I also get a push notification on my phone whenever a new device logs on, so unless the attack is _extremely_ targeted, well timed and they know what they want, Its not a risk for me.
        arinlen 4y ago
        > Thats a crazy level of risk assessment for an average user. It really isn't. Think about it for a second: how hard is it to spot phishing attempts when they are sent to an email address you know for a fact you're not using with a service? And how vulnerable are you to phishing if your special-purpose email address that you only use for one specific purpose receives zero spam? To claim that the most basic and easy internet security precautions are at a "crazy level", first you need to somehow believe that no one is targeted by these schemes. But somehow there's a whole international industry that thrives on stuff like Western Union transfers. Why is that?
        4y ago
  - Quekid5 4y ago
    The site would have to have a hell of a value proposition for that to be worth the effort.
  - bmn__ 4y ago
    "No way! Why should I change? He's the one who sucks."

Avamander 4y ago

Revolut does this for app logins and it's infuriating when your (new) phone doesn't have the email account used synchronized.

Zopieux 4y ago
This so much. If some Revoluter reads HN comments, please raise the concern, this is such a PITA.

jen729w 4y ago

It assumes that we all have access to our email all of the time. Which is a fair assumption for 99.99% of the population. But I deliberately keep email off my phone, so I don't look at email on my phone. So yes, I hate 'passwordless login'. I have a password manager, I can do it myself thanks very much.

arubania2 4y ago
You could consider setting up a separate email account just for the verification messages and have that on your phone.
- zhfliz 4y ago
  can you name even one service that uses login links and allows you to configure an address that is exclusively used for login links and not any other communication? i'm not talking about unselecting all other types of communication, but rather having the service store 2 different emails for you. one for logging in and one for communication.
  - arubania2 4y ago
    That is a fair point, indeed this would probably make the configuration page extremely complex. I guess my suggestion would only work for cases where you don’t really care much about other kinds of notifications.
- deleted 4y ago
  [deleted]
- ThePowerOfFuet 4y ago
  What a pain. Nope.
- blowski 4y ago
  Why should I have to go through all that faff when I have a perfectly good password manager?
  - arinlen 4y ago
    > Why should I have to go through all that faff when I have a perfectly good password manager? If you are not using dedicated special-purpose email addresses with specific services, you're already grossly mismanaging your online safety. Think about it for a second: how does your password manager help you if your email password gets leaked?
    - maccard 4y ago
      Thats a crazy level of risk assessment for an average user. > how does your password manager help you if your email password gets leaked? You still need my TOTP codes in my case at least, which conveniently are stored in my password manager. Is it perfectly secure? No, of course it's not, but frankly my risk profile isn't worrying about a targeted attack on me and my password manager, it's worrying about leaked shared credentials. Side note, I also get a push notification on my phone whenever a new device logs on, so unless the attack is _extremely_ targeted, well timed and they know what they want, Its not a risk for me.
      - arinlen 4y ago
        > Thats a crazy level of risk assessment for an average user. It really isn't. Think about it for a second: how hard is it to spot phishing attempts when they are sent to an email address you know for a fact you're not using with a service? And how vulnerable are you to phishing if your special-purpose email address that you only use for one specific purpose receives zero spam? To claim that the most basic and easy internet security precautions are at a "crazy level", first you need to somehow believe that no one is targeted by these schemes. But somehow there's a whole international industry that thrives on stuff like Western Union transfers. Why is that?
        4y ago
- Quekid5 4y ago
  The site would have to have a hell of a value proposition for that to be worth the effort.
- bmn__ 4y ago
  "No way! Why should I change? He's the one who sucks."