4 ms·
With the risk of repeating myself: https://passwordless.net https://passwordless.net I think we often overdo the simple things such as authentication.
by thesumofall 12y ago
With the risk of repeating myself: https://passwordless.net https://passwordless.net I think we often overdo the simple things such as authentication.
- adventured 12y agoI've looked at implementing an email auth system. My hold back is concern about delivery guarantees, particularly around speed. For example if I use Mailgun, a reputable service with good infrastructure and a very high rate of delivery. That still doesn't prevent random b.s. around emails not being delivered immediately due to any number of issues. If the user is left waiting for even more than a matter of seconds, they're going to give up / get annoyed. If I can guarantee instant email delivery, essentially, I'd probably jump to this auth method.
- thesumofall 12y agoGood point. My thoughts: - Email is not the only option to deliver tokens. You could also go for SMS, or both - For most registrations such emails are anyway commonplace. Combined with long sessions (where possible), I think the risks of delayed emails are low (compared to guys getting frustrated with the password) - I'm so far happy with Mandrill. But as you say: random b.s. can happen
- ams6110 12y agoRandom b.s. happens with SMS messages too. I've waited minutes for tokens from my bank's login system on more than one occasion. Also it's not always the case that a user has access to email when he's trying to log in to your app.
- thesumofall 12y agoYes, stuff happens. But as said: Most services use long-lived sessions. It's a choice: Trouble people with either insecure passwords and password resets, or take the risk that sometimes when a session was closed people might in rare cases not receive their tokens. Looking at my daily browsing I would be more than happy to get rid of most of the passwords.