Hacker News Reader

Comment by nickjj | Hacker News Reader

Just throwing this out there:

I won't use your service (no matter how good it is) if I had to check my email and click a link every time I wanted to login.

View on HN

There's a line and it depends on frequency of usage. If I login at least once a week, I will remember my password. There are, however, plenty of systems that I log in to far less frequently and consequently reset my password every single time. Reset requires an email confirmation. In that case, using the email link as the authentication is just steering into the skid.

Edit: I'd also suggest it's pretty easy to support either option for users with different levels of engagement.

There are systems that I use less than once a quarter, and checking e-mail is still more bothersome than password. Password managers, you know.

Just catching and throwing back:

Most of the time I need to log into your random service I'm doing a password reset anyways

I don't think it's that bad. Reminds me of my current login flow for some sites where I utilize 2FA.

The correct answer of course being optional passwords for the password manager using people.

Then both types of users are happy.

That's a good point, but there's plenty of services which are only used occasionally. For example, I practically never log into my domain admin panel - and as a result, before I started using a password manager, I'd wind up forgetting my password every time I needed to use it.

Conversely, for certain types of sites (medium being one), I'm more likely to sign up if I don't have to generate and store a new password. Even with a password manager it's a lot more friction than entering an email then clicking a link.

It depends on what password manager you use.

I like using pass[0].

It takes a legit 3 seconds to make an initial new password for a site and then accessing it requires running `pass Sites/medium.com -c" which copies the password to my clipboard for 45 seconds.

I don't even know what most of my passwords are because for the last few months I've started to use its built in feature to generate passwords that get past 99.9% of arbitrary password rules that a lot of sites enforce.

[0]: https://www.passwordstore.org/

I use 1password and it's great. But not having to use a password at all is still faster...

> But not having to use a password at all is still faster...

Not if it means having to check your email and wait for it to arrive.

But how many times do you actually have to log in? Depending on the site, you may never want to log out. So a login event can and probably should be very rare for most sites.

What about SMS? Would you use the service then? Genuinely wondering, I'm planning passwordless logins for my users.

No, but I'm also a huge edge case.

I don't use a smartphone. My non-smartphone does have an unlimited texting plan but I rarely keep my phone in the same room as me when actively using my workstation.

Mainly because when I'm in work mode, I put the horse rudders on and try to eliminate as many distractions as possible but also cell phones are known for creating line noise in audio equipment and part of what I do requires recording a lot of audio.

Hell no. And If I'm forced to I'll reroute it to email anyways.

I frequently don't have cell coverage but do have WiFi.

The article briefly states:

> You can give a cookie to user.

I suppose that once you logged in with a device, the idea is to keep you logged in.

Reply on news.ycombinator.com