3 ms·

I'm not sure I understand, you're saying that you are sending an email for every login? It surprises me that your testers seem to love that, it seems very obnox

I'm not sure I understand, you're saying that you are sending an email for every login? It surprises me that your testers seem to love that, it seems very obnoxious to me. I also don't quite understand: > After all, going through a password reset when you come back to the site is an easy way to lose people Most password reset forms I've seen just ask the user for their email, send them a link and ask them for a new password. This is nearly the same flow as your regular login flow, if I understand correctly?

tracker1 12y ago
I'm guessing there is a long (week or two) session cookie that they only need to re-confirm their email after a few weeks of not being on the site... maybe as a secondary token/cookie to re-entering their email, if it matches the second token, they're in... It'd be similar to 2fa, but without the first factor (a password).... I work on a similar site, where each real interaction is a financial transaction... since there's no real need to login after that transaction, there's no password, they're buying a product, and that is delivered via email... no need for the hassle of creating an account to login with... an account is made with a random password under the covers, but it's never really needed.