Controversial. First, it's nice to have new thoughts. But I am not a closed-mind person, plus I am new to security so I am fairly open to new ideas. > It might

Controversial. First, it's nice to have new thoughts. But I am not a closed-mind person, plus I am new to security so I am fairly open to new ideas. > It might seem strange, but a sign-up flow in which people set the password as late as possible (or never at all!) are generally going to convert at a higher rate. I am not interested in conversion rate. Amazon does not lock you in to sign up if you are just browsing. If you want to purchase, you might. I am sure there are sites out there do guest checkout or add to cart and sign in later. That's great. So about the number of users who are going to sign up and not sign up depends on the situation. > simply keep a user logged in for a very long time (1 year+), but require a password to change key account information. Simple and effective. We trade too much security for convenience. Having long time session for Amazon-like site? That's a bad idea. Imagine me telling you your computer will now log in Citibank for 365 days. And we tell people don't save password for such high-profile site? If you lose your computer and the theft was able to access your browser, that cookie can do a lot of harm. > But my favorite site is craigslist. As you noted later, your solution works for certain types of website. Using Amazon to establish a story and propose a solution makes the solution weak and confusing. > I realize that there are also security trade-offs, but it isn't a coincidence that the #1 online retailer, the #1 classified ad site, the #1 daily deal site all trade-off a slight amount of security for convenience. You are talking about a site which handles transaction with banks and merchants, vs a site that handles text ads display. In your final lines: > An email/password prompt should not be the first thing on your sign-up form. Sorry, what? You just said it would be nicer to just send an email to the user. Now you are suggesting, let's not. Also, the downside of providing a password later is that people will not do that later. You can, of course, force them to provide a password when they do critical things like "to checkout, please provide password." So why save that headache? Is the use case about "I want to save my watchlist on Amazon but I don't yet want to provide my password to Amazon?" This is the only usecase which I think is fair but severely limited and thus may well be considered unimportant in the end. > Use long term cookies to keep people logged in. Like Amazon or Groupon, if somebody has logged in once on a computer, let them do common hard-to-abuse things without a password. > Log users in from emails clicks automatically. No. How can you verify it is ME clicking it? Because i am the only one who can access the email? So if such link is leaked (or the link generation is hacked), I can log in as anyone without even trying to hack your database. If my email is doom password reset is doom? Okay, fine. But we are all advocating to implement better, more secured multi-factor authentication, why are we now falling back to minimal authentication again? While I agree password cannot verify one's identity entirely and email is also hackable, I think simple design like AUTHENTICATION all the way is simpler. There might be cases in which authentication is unnecessary - but I probably won't recommend myself even thinking about this new idea.