4 ms·

Is this any better than a link that logs you in automatically? A link would be easier and more secure. I've actually been thinking of that as a super simple log

by jere 13y ago

Is this any better than a link that logs you in automatically? A link would be easier and more secure. I've actually been thinking of that as a super simple login method lately, but I don't know if people would use it. As a proof of concept, I couldn't actually get your site to work because by the time I understood the UI flow, it was throwing an alert saying "Error with that email address". Also, this goes to spam for me... just to let you know.

brent_noorda 13y ago
No, it's not better than a link that logs you in automatically, just different. I don't think a 5-digit code is hard to remember for a few seconds, so I like this one. Sometimes the auto-links bother me because they might open a different browser than I want, but that's only a minor issue. I'm thinking of adding a log-in link to the email, in addition to the 5-digit code, for people that prefer that method. That way they'd have both options in the same email.
- jere 13y ago
  Cool! I think that's a great idea. Also, I really would try to smooth out the login flow even for a POC. If I accidentally enter an old code (even if it's 5 minutes) it won't let me in. That seems OK. However, what happens next is I copy the correct/latest code, but the UI asks for my email again to send another code. When I paste in the code I have copied, it's invalid yet again.
  - brent_noorda 13y ago
    I agree that can be odd. I made this decision to defeat bots that may be trying to fake their way in. Since it's only a 5-digit code it wouldn't take a bot long to guess the right code. By invaliding the code the first time a wrong one is used I think it makes bots very unlikely to guess correctly. I think. I hope.
brent_noorda 13y ago
Your link-to-log-in-automatically is a good idea. I've now added that. The email you receive now has two methods of logging in: 1) the 5-digit security code (the method I prefer) and 2) a direct link (the method you prefer). Thanks for the idea.

by jere 13y ago

brent_noorda 13y ago

No, it's not better than a link that logs you in automatically, just different. I don't think a 5-digit code is hard to remember for a few seconds, so I like this one. Sometimes the auto-links bother me because they might open a different browser than I want, but that's only a minor issue. I'm thinking of adding a log-in link to the email, in addition to the 5-digit code, for people that prefer that method. That way they'd have both options in the same email.

jere 13y ago
Cool! I think that's a great idea. Also, I really would try to smooth out the login flow even for a POC. If I accidentally enter an old code (even if it's 5 minutes) it won't let me in. That seems OK. However, what happens next is I copy the correct/latest code, but the UI asks for my email again to send another code. When I paste in the code I have copied, it's invalid yet again.
- brent_noorda 13y ago
  I agree that can be odd. I made this decision to defeat bots that may be trying to fake their way in. Since it's only a 5-digit code it wouldn't take a bot long to guess the right code. By invaliding the code the first time a wrong one is used I think it makes bots very unlikely to guess correctly. I think. I hope.

brent_noorda 13y ago

Your link-to-log-in-automatically is a good idea. I've now added that. The email you receive now has two methods of logging in: 1) the 5-digit security code (the method I prefer) and 2) a direct link (the method you prefer). Thanks for the idea.