Comment by stetrain
1 month ago
I think they're referring to sites where that is the only way to sign in, which I have seen a few of. Basically you can never register a password or passkey, every sign in requires going to your email and waiting for the link to arrive.
I've seen Slack and Claude doing this among others, it's turned into one of my leading red flags for untrustworthyness.
I get the idea. If email links are secure enough to use for password resets, just do that every time. Then you eliminate a whole category of password attacks.
But it’s definitely annoying for a frequently used service.
Maybe this gets us closer to some idea of email being a more protected digital service, that has some legal guarantees?
Putting the potential negatives under the rug for a second…
I would be nice to have email that (1) you can’t get locked out of arbitrarily, (2) acts similarly to US mailbox (in its protections and universal service), (3) acts as an identity
Is this a bad idea?
2 replies →
A German neighborhood social network uses this, and I prefer this over all other sites I visit that have passwords.
I only need a new login link when I switch to a new browser or device, so it's not really annoying at all.
I do it for small projects with about 10 infrequent users. They would ask me to reset it almost every time anyway.
Though next time I'll probably try oidc if I can find a common provider that isn't a hassle
Untrustworthy... yes.
I get more annoyed by the timeout it adds. Logging in 10 years ago? A thing of seconds.
Logging in today? Either magic links through mail (delivered to you within the next 30min thanks to graylisting or spam filters) or a login flow with requires 5 dialogs and 5 confirmation of "no, just log me in".
I think all Shopify sites also do it now? I'm migrating password managers and have been going over all of the old accounts I've had. Several sites that use Shopify for their stores now just don't accept any kind of a password.
I despise that too. One website (was it walmart?) gives me option to use that or a password, I select password and after entering it it tells me that it needs to verify my e-mail "for security" where I get link or code to log in.
At that point what's the point of password? Just an optional extra step?
Correct; that's what I'm talking about. Sites that send you a link first before letting you enter a password (Spotify) are also on my bad list.
I mean, if the session token basically never expires it's kind of fine?