5 ms·
Tell HN: I Don't Want to Use Email as a Password
Old classic flow:
I enter a username and a password. If it's important I set up 2FA and use a timed code or SMS if I have to.
New flow:
I try to log in using my email address. The site generates a code that I now have to go and fish out of my email, cut, and paste in, to get into the site, instead of just proceeding to enter the password that's in my password manager.
Am I the only one that thinks this new approach to logging in just sucks?
- iteria 3y agoIt's not for you. It's for people who don't know what a password manager is and can barely remember their password. If they actually remember it. Many people rely on their phones always having access. I have dealt with a lot of family members who absolutely cannot be trusted to remember even a single password if they don't have to type it in semi-regularly. I've have family members locked out of password vaults because 2 weeks is too long to expect them to remember a password. This is who that flow is catering to. It's a significant amount of people, sadly.
- jollyllama 3y agoIt's a logical consequence of expecting people to authenticate fully with services in a physical context outside of a computer desk at home where passwords can be safely written down. Unfortunately a hardware key is simply the modern version of this. What would be better is the issuance of limited permissions for other context in the form of less secure tokens. An example of this is the old school example of logging into your airline account and printing out your tickets to take to the airport.
- skydhash 3y agoI was watching a demo of palm pda and I liked the fact you have a syncing software on your computer. I'd gladly sync auth secrets to my iPhone so I can access services instead of authenticating on the phone itself.
- rubyissimo 3y agoI want to like passkeys, but so far it feels like they've just confused the issue.
- sergiotapia 3y agoIt sucks. Another horrible pattern is that enter email, hit enter THEN we'll show you the password field. What kind of puddinghead cooked that up I wonder.
- runjake 3y agoHere's what Google said when they implemented it: "Today, you sign in to Google on a page that includes both the ‘email’ and ‘password’ fields on the same page. We’ll be gradually splitting those two fields into separate pages in the coming days; the sign-in process won’t change otherwise. As we’ve said many times, we're working towards introducing new authentication solutions that complement traditional passwords. We’ve already separated the ‘username’ and ‘password’ fields onto separate pages on a successful launch in Android last year. This change to our web sign-in page is another step in that direction. To help make sign-in easier and more personal, you may see a screen with your profile picture and full name when signing in to Google. We’ll only show this information if you are signing in from a location or device you’ve signed in from before, like your home computer." I have no opinions on it. At least, no positive opinions.
- sergiotapia 3y agoCrazy they just skip past the why. Why split it in the first place lol
- runjake 3y agoThey state why, albeit poorly worded and justified: > we're working towards introducing new authentication solutions that complement traditional passwords Anyway, terrible explanation on Google's part, IMHO.
- Moomoomoo309 3y agoMy college uses this. It redirects to their login system when you put your school email in on gmail.
- codingdave 3y ago
- VoodooJuJu 3y agoWhile it bothers me as well, this flow isn't too common. It's usually only used for MVPs because of how quick and easy it is to set up. What I'm more bothered about is that sites who use traditional username/email and password increasingly don't actually seem to care about my password. They always require 2FA, email or phone, and I don't have a choice. Username + password simply isn't good enough for these people anymore.
- clusmore 3y agoA lot of companies have started doing this because a compromised account can be used to attack the service (logged in sessions avoid rate limits) or other users (spam). They aren't necessarily trying to protect you.
- curmudgeon22 3y agoI am seeing this much more frequently in services I use. Rarely, they have a small option that says "use password instead". I agree that it's pretty frustrating, since I have strong passwords in my password manager. Like another poster, I assume its used because it provides better security for the majority.
- joegahona 3y agoI’ve been getting increasingly crazy permutations of login flows recently. I swear one of them recently was: Enter email address, go fish code out of email inbox, cut and paste code in, then get a password field.
- sethammons 3y agoemail as a login flow is gonna cause problems. Email can be delayed for days.
- NikkiA 3y agoSo can SMS, it hasn't stopped idiots designing 2FA around it.
- tonymet 3y agoI agree it sucks. It ads a complex & flimsy step to an already brittle login process. A big problem is captive browser cookies. Gmail for example uses a captive browser for links. The flow from Safari --> Gmail --> captive browser means that your login session is lost in captive browser limbo. Authentication is so kludgy, and all the attempts at securing it lead to horrific UX. How many screens does it take to log in: 1. enter username, 2. enter password 3. enter 2fa, 4. verify email 5. open email inbox 6. open email with code 7. Open captive browser 8 ( if you are lucky) Open the original browser to log in. 8 screens that each could succeed or fail or the user can get lost.
- pseudocomposer 3y agoI agree these flows suck, and others have described why companies do this. But I’ll also note there is a solution: use Apple Mail and Safari. Just as with Messages and SMS 2FA codes, it can auto-fill the code that was emailed to you, and delete the email when you do so.