4 ms·

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email w

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

seanthemon 2y ago
Or maybe password managers need to catch up with this newly forming flow
- abdullahkhalids 2y ago
  Keepassxc (and its browser extension) can do this easily. You just have to one time define that the website only takes a username field. After that it will autofill the correct email in the field.
- wpm 2y ago
  Perhaps, a password manager managed email address used solely for these stupid links and codes. Why email then? Why not some other, better protocol? Why not just use a TOTP at that point?
  - al_borland 2y ago
    > Why not just use a TOTP at that point? Friction. When the username is an email address, 100% of people logging in have an email address. Telling someone they need to setup TOTP, especially if they have never done so before, is going to be a bridge too far for something they may only use once or twice. One site I remember using this email code login was a small online store. If I was prompted to setup TOTP to buy something, I would have probably not bought anything. If my mom was prompted for that, she’d end up calling me, and I’d have to try to walk her through the whole thing… then I’d keep getting calls the next 5 times she’s had to login. If the site gives directions on what to do, they will probably only be written targeting a single authenticator app. For people who don’t yet know that the apps are generic (in most cases), this can lead to a user having 3 sites setup in 3 different apps. It can become a mess very quickly.
- archerx 2y ago
  Or this stupid flow needs to die.
EasyMark 2y ago
I get this a lot because I use Mullvad 99%of the time. I hate it, but I put up with it because I don’t have much choice. I guess they’re flagging the “popular” ip address that I’m using.
- al_borland 2y ago
  If it’s only doing it because of your VPN, I think I’m talking about something else. This isn’t where you put in a username and password, then get an email code prompt because something looks off. In the case I’m talking about, the user has no password. This is just the way it is, VPN or not.
hnick 2y ago
We offered it on a site with a "guest login" where people redeem vouchers but might not want to make an account. So I think that's one valid use case. We need to associate the voucher with the email, so we need to ensure they own it by clicking the link, in case of support hassles down the line for lost vouchers. And if they make the account later they can see their old ones from before.
esafak 2y ago
It means the site doesn't store your password, so you have less to worry about.
- al_borland 2y ago
  That’s the reason I can understand why they do it. It’s less information they are holding on to, and they effectively outsource authentication to the email provider.
lelanthran 2y ago
> I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. I do this with a B2B SaaS: an individual user would log in maybe once of twice every six months. Have passwordless logins means: 1. No added pressure on the user to remember a password for a service they use rarely. 2. Easier onboarding for companies, as they upload a CSV of all their users and their users can get to work immediately without being prompted to create a password, double-check it, confirm it, adhere to the rules, etc. I don't like using links in emails, as they get 'clicked' by many phone apps when previewing, by corporate virus scanners, etc.
archerx 2y ago
I have stopped giving websites money because the friction of using magic links was too much and I found alternatives that didn’t involve such a dumb login system. My theory is if you can’t make a proper login system you’re skills probably aren’t good enough to deliver on what you’re promising. Magic links have turned from an annoyance to a filter for me.
- lbriner 2y ago
  "My theory is if you can’t make a proper login system you’re skills probably aren’t good enough to deliver on what you’re promising." Using that logic, I wouldn't trust most websites I visit. Even FAANG companies with their billions can't do certain things properly. Even something reallly basic like focus the 2FA box when you ask for the code, don't make me have to click on it! Don't stop people pasting passwords, don't limit how long the password can be (within reason) don't say they can't use arbitrary characters like a - because "SQL Injection" and don't invent riduculous hurdles like adding random digits from a secret word as well as your password. If you are going to do that, just ask for two passwords or tell people if you choose stupid passwords, you will be hacked! I like the password strength meter that doesn't block passwords that it has mistakenly decided are weak (20 random alpnanumerics) but instead estimates how quickly it could be hacked. People don't understand entropy but might understand "hacked in 5 minutes", they also don't want to be told that your password has to be at least 100 characters long with uppers, lowers, numbers, specials, klingon etc. If your system is that susceptible you are doing it wrong.
  - archerx 2y ago
    Don’t look at FAANG as examples, they are usually the leaders in modern day bad UX.
darajava 2y ago
I would say a huge proportion of non-technical consumers do not use a password manager. By only offering password signup and not magic links/codes, I am probably making life harder for the vast majority of consumers. Even if I offer both options, I would guess that I’d see more drop off during my signup flow by asking for a password as well as verifying their email. Not to mention the code is way simpler without dealing with passwords and multiple login flows for email.

seanthemon 2y ago

Or maybe password managers need to catch up with this newly forming flow

abdullahkhalids 2y ago
Keepassxc (and its browser extension) can do this easily. You just have to one time define that the website only takes a username field. After that it will autofill the correct email in the field.
wpm 2y ago
Perhaps, a password manager managed email address used solely for these stupid links and codes. Why email then? Why not some other, better protocol? Why not just use a TOTP at that point?
- al_borland 2y ago
  > Why not just use a TOTP at that point? Friction. When the username is an email address, 100% of people logging in have an email address. Telling someone they need to setup TOTP, especially if they have never done so before, is going to be a bridge too far for something they may only use once or twice. One site I remember using this email code login was a small online store. If I was prompted to setup TOTP to buy something, I would have probably not bought anything. If my mom was prompted for that, she’d end up calling me, and I’d have to try to walk her through the whole thing… then I’d keep getting calls the next 5 times she’s had to login. If the site gives directions on what to do, they will probably only be written targeting a single authenticator app. For people who don’t yet know that the apps are generic (in most cases), this can lead to a user having 3 sites setup in 3 different apps. It can become a mess very quickly.
archerx 2y ago
Or this stupid flow needs to die.

EasyMark 2y ago

I get this a lot because I use Mullvad 99%of the time. I hate it, but I put up with it because I don’t have much choice. I guess they’re flagging the “popular” ip address that I’m using.

al_borland 2y ago
If it’s only doing it because of your VPN, I think I’m talking about something else. This isn’t where you put in a username and password, then get an email code prompt because something looks off. In the case I’m talking about, the user has no password. This is just the way it is, VPN or not.

hnick 2y ago

We offered it on a site with a "guest login" where people redeem vouchers but might not want to make an account. So I think that's one valid use case. We need to associate the voucher with the email, so we need to ensure they own it by clicking the link, in case of support hassles down the line for lost vouchers. And if they make the account later they can see their old ones from before.

esafak 2y ago

It means the site doesn't store your password, so you have less to worry about.

al_borland 2y ago
That’s the reason I can understand why they do it. It’s less information they are holding on to, and they effectively outsource authentication to the email provider.

lelanthran 2y ago

> I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. I do this with a B2B SaaS: an individual user would log in maybe once of twice every six months. Have passwordless logins means: 1. No added pressure on the user to remember a password for a service they use rarely. 2. Easier onboarding for companies, as they upload a CSV of all their users and their users can get to work immediately without being prompted to create a password, double-check it, confirm it, adhere to the rules, etc. I don't like using links in emails, as they get 'clicked' by many phone apps when previewing, by corporate virus scanners, etc.

archerx 2y ago

I have stopped giving websites money because the friction of using magic links was too much and I found alternatives that didn’t involve such a dumb login system. My theory is if you can’t make a proper login system you’re skills probably aren’t good enough to deliver on what you’re promising. Magic links have turned from an annoyance to a filter for me.

lbriner 2y ago
"My theory is if you can’t make a proper login system you’re skills probably aren’t good enough to deliver on what you’re promising." Using that logic, I wouldn't trust most websites I visit. Even FAANG companies with their billions can't do certain things properly. Even something reallly basic like focus the 2FA box when you ask for the code, don't make me have to click on it! Don't stop people pasting passwords, don't limit how long the password can be (within reason) don't say they can't use arbitrary characters like a - because "SQL Injection" and don't invent riduculous hurdles like adding random digits from a secret word as well as your password. If you are going to do that, just ask for two passwords or tell people if you choose stupid passwords, you will be hacked! I like the password strength meter that doesn't block passwords that it has mistakenly decided are weak (20 random alpnanumerics) but instead estimates how quickly it could be hacked. People don't understand entropy but might understand "hacked in 5 minutes", they also don't want to be told that your password has to be at least 100 characters long with uppers, lowers, numbers, specials, klingon etc. If your system is that susceptible you are doing it wrong.
- archerx 2y ago
  Don’t look at FAANG as examples, they are usually the leaders in modern day bad UX.

darajava 2y ago

I would say a huge proportion of non-technical consumers do not use a password manager. By only offering password signup and not magic links/codes, I am probably making life harder for the vast majority of consumers. Even if I offer both options, I would guess that I’d see more drop off during my signup flow by asking for a password as well as verifying their email. Not to mention the code is way simpler without dealing with passwords and multiple login flows for email.