Ask HN: Any obvious disadvantages to password-less, email-only login?
4 comments
Check out Fork the Cookbook[0], which uses such a thing. The main complaint (about 10 each week) is that people expect to have only one password. It's not really as user friendly as you think
[0]: http://forkthecookbook.com
[0]: http://forkthecookbook.com
people expect to have only one password
Fork the Cookbook emails the user a password, but that's not what I'm suggesting. What I'm suggesting is completely password-less: You receive a link like http://example.com/log-in/0039392030202 in your email and just click that to log in and stay logged in for e.g. two months.
Fork the Cookbook emails the user a password, but that's not what I'm suggesting. What I'm suggesting is completely password-less: You receive a link like http://example.com/log-in/0039392030202 in your email and just click that to log in and stay logged in for e.g. two months.
This is how it looks like: http://imgur.com/zTGaVNF
The link expires within an hour, and once logged in you're logged in for a day.
People complain about that shit every week. We switched to Persona for a week. Even worse results. The only reason why I'm keeping this for FtC is because I don't want to deal with passwords and hashing and stuff.
The link expires within an hour, and once logged in you're logged in for a day.
People complain about that shit every week. We switched to Persona for a week. Even worse results. The only reason why I'm keeping this for FtC is because I don't want to deal with passwords and hashing and stuff.
2 months?
Or something similar. The important thing is that they shouldn't have to log in each time they visit the website, because then using email would cause the login process to be too slow. Again, using the password-less login for websites with sensitive data (such as banking) wouldn't work, since those sites require the user to log in for each session.
we used this on a project. it works pretty well.
a few obvious, but ok issues are.
1) if the person uses a computer where they dont have access to their email its a problem
2) the person forwards the link to others to use
3) sometimes emails get delayed
lastly a less obvious issue
4) people expect to use username/password, which means most of the users we had, had to be educated on how to log in. even when it clearly said what they had to do.
a few obvious, but ok issues are.
1) if the person uses a computer where they dont have access to their email its a problem
2) the person forwards the link to others to use
3) sometimes emails get delayed
lastly a less obvious issue
4) people expect to use username/password, which means most of the users we had, had to be educated on how to log in. even when it clearly said what they had to do.
check out Persona https://login.persona.org
Persona is a no-go for me - I just don't believe that it will ever take off now that Mozilla has put it in maintenance mode. Mozilla has vowed to keep the servers up, but other than that they don't seem to be doing anything to further Persona's mainstream adoption.
If you use multiple different computers, especially public computers, you won't stay logged in for two months (or whatever). This is not necessarily a big deal assuming you don't have a problem with them logging in over and over and over. It won't necessarily be that big of a convenience to such a person and might make them very self conscious of their lifestyle difference (for example, they are poor and only log in on public library terminals which have a time limit -- your assumptions about computer usage are kind of upper class) especially if, for some reason, you decide that their difference in usage makes them "suspicious" (a common occurrence for the underclass) and begin making life more difficult for them simply because their usage differs from the scenario you expected.
This would not work for really sensitive stuff (e.g. banking) where you need to log in each time you visit the site, but for normal sites it's really user-friendly.
My question is: Are the any disadvantages to this model? The only one I can think of is the situation where you've deleted your old email address and some time after that have to log in to a website that uses password-less login. But that is probably a rare occurance and could be fixed by contacting support.