4 ms·
I would like a magic link to email + long time bearer cookie. Extremely simple. Email is used for recovery anyway. Is there any deal-breaking downside to that?
by klabb3 4y ago
I would like a magic link to email + long time bearer cookie. Extremely simple. Email is used for recovery anyway. Is there any deal-breaking downside to that? Is it worth using eg Google to prevent abuse of e.g. excessive free tier account creation or spammers?
Use case: SaaS for non-techies on desktop, international audience with payments for premium service.
- mejutoco 4y agoI am a big fan of that. The only problem I can see is that often the device receiving the email is not the one performing the authentication (i.e. I am on my desktop and I open the email on my phone). If instead of a link there is a code to enter IMO (or maybe both) this system is very good.
- voxic11 4y agoOr as an alternative to manually copied codes you can include a QR code.
- klabb3 4y agoYes but QR relies on camera which often isn't available on desktop. A common use case would be sign in on desktop, check email on phone. The code needs to be brought back to the desktop.
- Fire-Dragon-DoL 4y agoCould you have the qr code being scanned from the phone and the act of accessing the url on the phone is what allows the desktop to login? What would be the downsides of this approach?
- klabb3 4y agoGood point. Thanks! Code is good but needs lower adaptive entropy (nobody wants to write a sha256 by hand).