Hacker News Reader

Comment by redrove | Hacker News Reader

>And please please use "forever auth" with passkeys or something, what is up with that auth email that just takes ages for a quick glance?! It always takes me 3 attempts to find what address I used at sign-up...

As a person with the simple but brilliant technology of a freaking password manager, I LOATHE email to login/no-password websites. They are dreadful, we've somehow managed to come up with something worse in UX rather than move forward.

If you're working on a product that does this, or wants to do this, please please PLEASE reconsider, it's such a PITA for technical users and normies alike.

View on HN

I used to think the same thing, and I still want a login/password alternative for me. But after seeing normies use online accounts and the trouble they have with password managers, I realized one of my friends had the most secure process: she would create extremely high-entropy passwords everywhere, but not remember them. Once she's logged out of her sessions after a couple of months, she uses the password forgotten link to generate another password, and so on. So her passwords are never stored anywhere, she's immune to many login stealing phishing attempts through genuine-looking fake websites as she can't enter the password, she doesn't have to deal with syncing the passwords between all her devices, and she doesn't have passwords on a post-it on her workstation. And she also doesn't get those annoying emails saying "your password is 6-months old, please change it or else!".

The email auth flow is a simplified and more efficient way to achieve the same outcome.

yeah, I find it annoying, but it's a simple way of making something secure, piggyback on something that already made a decent effort at trying to being secure enough.

Another reason to ditch email-to-login: It decreases active user count because login is such a chore. I only use those websites if I absolutely have to and there are no alternatives.

Yeah, it's the reason I eventually tuned out of Slack too (obviously I don't use it day to day). I used it for some things, some community stuff, every now and then.

So when I open it up on a new machine or after months, you have to go through that magic link bs multiple times! For all your accounts/channels! I did that 2 or 3 times and then I just stopped using it.

I don't even remember what I signed up for over the years, I know some of it was nice (like an LoRa IOT channel, an "AWS professionals" channel, I set something up for the LoRaWan network in the previous city I lived in... All just tuned out because of the login bs.

I don’t get why Slack can’t figure out how to help me migrate all my workspaces on a device I still have and am logged into in a new one in fewer than 3 steps per workspace. Sure, if I’ve lost all devices with the workspaces connected, maybe it needs to be that much PITA, but it’s a pretty common case to add/switch to a new machine or device and that process is obnoxiously poorly executed right now.

Reply on news.ycombinator.com