Comment by rdsubhas
1 month ago
> what I'd REALLY F'IN LOVE to see go away is the passwordless/magic link auth flow
This seems really naive? That's the only flow that's at the basis if you get locked out. What else, do you put people on the phone to verify people by asking their name and date of birth? That's even worse!
I think they're referring to sites where that is the only way to sign in, which I have seen a few of. Basically you can never register a password or passkey, every sign in requires going to your email and waiting for the link to arrive.
I've seen Slack and Claude doing this among others, it's turned into one of my leading red flags for untrustworthyness.
I get the idea. If email links are secure enough to use for password resets, just do that every time. Then you eliminate a whole category of password attacks.
But it’s definitely annoying for a frequently used service.
5 replies →
Untrustworthy... yes.
I get more annoyed by the timeout it adds. Logging in 10 years ago? A thing of seconds.
Logging in today? Either magic links through mail (delivered to you within the next 30min thanks to graylisting or spam filters) or a login flow with requires 5 dialogs and 5 confirmation of "no, just log me in".
I think all Shopify sites also do it now? I'm migrating password managers and have been going over all of the old accounts I've had. Several sites that use Shopify for their stores now just don't accept any kind of a password.
I despise that too. One website (was it walmart?) gives me option to use that or a password, I select password and after entering it it tells me that it needs to verify my e-mail "for security" where I get link or code to log in.
At that point what's the point of password? Just an optional extra step?
Correct; that's what I'm talking about. Sites that send you a link first before letting you enter a password (Spotify) are also on my bad list.
I mean, if the session token basically never expires it's kind of fine?
For services that have your PII or payments details, yeah, that should be the only way to do a reset. Super inconvenient but much less so than dealing with stolen identity or credit cards.