2 ms·
I applaud the attempt to move away from passwords, but this seems like a pretty annoying solution. I don't want access to my email to be tied to my access to "
by habosa 14y ago
I applaud the attempt to move away from passwords, but this seems like a pretty annoying solution. I don't want access to my email to be tied to my access to "The Magazine". If I'm going to need to access some other service to log in, I'd prefer a Google Authenticator style solution where my access code is always a single click away from my phone's home screen. Maybe Marco/The Magazine could use Google Authenticator and just accept any password as long as the auth code is right, it seems like that would provide the same level of security as this solution.
As a side note, wouldn't someone trying to gain access to my account result in a deluge of password-link spam to my inbox? Or do they have some elegant solution for that.
- mjschultz 14y agoThe deluge wouldn't be worse than a targeted attack with a reset password style system, right?
- bigiain 14y ago"wouldn't someone trying to gain access to my account result in a deluge of password-link spam to my inbox?" Pretty easy to rate-limit that per-email-address. No need to send more than one password-link email per 5 minute or more than a handful a day.
- jader201 14y agoI think this is a big factor, and why I think this is a really bad UX. I've actually considered this method of authentication in the past, but the only thing this fixes is this site having to remember a password for you (and the accompanying side effect of the vulnerability of your password being compromised). Now, the user not only has to hold onto the login email (or request a new one), but they have to access that email every time you use the site -- or, bookmark the URL (yuck). Not to mention the issue if they're on another device that doesn't have access to the email address. This may work as a secondary, optional method of authentication. But having it as the only method isn't a good UX.