|
| ▲ | chrisandchris 2 hours ago | parent | next [-] |
| Untrustworthy... yes. I get more annoyed by the timeout it adds. Logging in 10 years ago? A thing of seconds. Logging in today? Either magic links through mail (delivered to you within the next 30min thanks to graylisting or spam filters) or a login flow with requires 5 dialogs and 5 confirmation of "no, just log me in". |
|
| ▲ | stetrain a day ago | parent | prev | next [-] |
| I get the idea. If email links are secure enough to use for password resets, just do that every time. Then you eliminate a whole category of password attacks. But it’s definitely annoying for a frequently used service. |
| |
| ▲ | hobo123 13 hours ago | parent | next [-] | | A German neighborhood social network uses this, and I prefer this over all other sites I visit that have passwords. I only need a new login link when I switch to a new browser or device, so it's not really annoying at all. | |
| ▲ | callc a day ago | parent | prev | next [-] | | Maybe this gets us closer to some idea of email being a more protected digital service, that has some legal guarantees? Putting the potential negatives under the rug for a second… I would be nice to have email that (1) you can’t get locked out of arbitrarily, (2) acts similarly to US mailbox (in its protections and universal service), (3) acts as an identity Is this a bad idea? | | |
| ▲ | tancop a day ago | parent | next [-] | | Only if it's run by the state and free for every citizen. Forcing more bureaucracy on email providers will just make everything more centralized under Google and Microsoft. It should be a mailbox with E2E encryption where the keys are stored on your ID card. Backups stay on secure servers that are legally protected from anyone including the police and only given out when you're getting a new ID at a government service center, encrypted with the cards public key so a hacker in the card issuing system can't steal it. Every user gets a persistent address used as their identity, and any number of anonymous ones. Locking someone out would be both illegal and inconvenient for the government if all their official business is going through the mailbox. | |
| ▲ | nunez a day ago | parent | prev [-] | | Horrible idea. This will require every email vendor to certify with every country they provide service to that wants to do something like this, which will pretty much kill any small/indie email hosting providers. I'd much rather have stricter legislation around password resets built into existing reg frameworks like PCI or HIPAA. If you store a form of payment or PII with a provider, then some form of human verification should be needed to perform a password reset. |
| |
| ▲ | KnightHawk3 a day ago | parent | prev [-] | | I do it for small projects with about 10 infrequent users. They would ask me to reset it almost every time anyway. Though next time I'll probably try oidc if I can find a common provider that isn't a hassle |
|
|
| ▲ | takeda 21 hours ago | parent | prev | next [-] |
| I despise that too. One website (was it walmart?) gives me option to use that or a password, I select password and after entering it it tells me that it needs to verify my e-mail "for security" where I get link or code to log in. At that point what's the point of password? Just an optional extra step? |
|
| ▲ | Hamuko a day ago | parent | prev [-] |
| I think all Shopify sites also do it now? I'm migrating password managers and have been going over all of the old accounts I've had. Several sites that use Shopify for their stores now just don't accept any kind of a password. |
