3 ms·
This is interesting. A lot of social networks use this sort of authentication for their email notifications, and weekly/daily digests, but don't treat it as a f
by codezero 12y ago
This is interesting. A lot of social networks use this sort of authentication for their email notifications, and weekly/daily digests, but don't treat it as a first class login.
Facebook, LinkedIn, Twitter, Quora, etc... use a short expiration on these, but if you ever forward one of your new notifs to a friend, they will end up logged into your account, which is surprising. It usually only lasts for the session, and some are pretty good about double checking if you are coming from a new location or have cookies for another account set :)
For longer lasting sessions, email security seems like a big concern, especially since most people keep all their email forever (gmail) and it's easy to search through.
- thesumofall 12y agoAlmost :-) The tokens are one-time only. Afterwards the session is keeping track of the user. Another login requires a different token. Regarding the emails of Facebook, etc.: Great example, actually! I guess the problem really is that they don't make it obvious to users that they actually hold an authentication token in their hands.
- codezero 12y agoYeah I assumed they were one-time only. In examples I've seen, each link had a different token, so if you forwarded something, one of the links may work if you hadn't clicked that particular one. When ever I explain this to people, and forward them one of my notifs from Facebook, they get pretty paranoid and shocked, then eventually accept it because of the convenience :)