12 ms·

Ask HN: Why not to use passwordless login?

22 points by ivanpashenko 9y ago

Is there a reason why new services are not using passwordless login? (Type your email -- receive the code -- fill in the code)

lwlml 9y ago
It is a cultural problem. I think the "younger" users don't use e-mail as much as they do other forms of "Internet" e.g. Facebook for authentication. Otherwise, I'm loathe to give out my e-mail address because of spamming and data-collection.
deleted 9y ago
[deleted]
pavel_lishin 9y ago
As a consumer of services, it's not more convenient for me than clicking the Lastpass (or your password manager of choice) icon and filling in the login form. Plus, I imagine some people may have multiple email accounts, and would have to hunt through them to figure out which one they used to sign up with. (Similar to my problem with StackOverflow; I can never remember which identity provider I used to sign up with them, and end up just clicking on all of them in order until one lets me in. For all I know, I might have multiple accounts.)
- shanecleveland 9y ago
  Not saying your are wrong in your preference, but you can similarly use a password manager to save the email address used for a password-less login. So perhaps not a good argument against passwordless logins in general, though I am sure there are many good reasons against it. So far, the few arguments against here are individual, convenience-based reasons. Those are certainly valid reasons, because if you inconvenience a potential user, they may never become an actual user. Not everyone has a password manager, and many people use the same username, email and password across many services. The larger danger can be that if one service is hacked, it may provide a hacker access to many services, including email. A provider of a service with a passwordless login would never have to worry about being the root cause of such a breach. And, as long as the users' email was not hacked, would not be susceptible to malicious activity through another hacked service. One question for the OP: What kind of service are we talking about? If the information is sensitive, then perhaps it is not a good idea. If it would be safe to keep a user logged-in after a session ends, then maybe a good consideration. By limiting the number of login requests, then you reduce the inconvenience.
  - pavel_lishin 9y ago
    > you can similarly use a password manager to save the email address used for a password-less login Sure, but it still adds an extra step; my current manager doesn't have a "log into the email address you used to register with this site" button. But you're right, there are advantages to email-based login.
    - shanecleveland 9y ago
      You're right about that extra step, which may be crippling enough to keep users away.
BjoernKW 9y ago
Plenty, both in terms of security and UX: 1.) It's less secure (unless the email is encrypted, which in most cases it is not). 2.) If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email. 3.) Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the purpose for the operator to have a less complex authentication system to worry about).
- ngrilly 9y ago
  > It's less secure (unless the email is encrypted, which in most cases it is not) I disagree. With opportunistic encryption, if the recipient' server supports STARTTLS, then the communication between the sender' server and the recipient' server is encrypted using TLS. Nowadays, all major email service providers support STARTTLS. > If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email. Just use the GMail to avoid the delay with fetching third party accounts. > Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the purpose for the operator to have a less complex authentication system to worry about). I mostly agree, but: 1/ Alas, most users don't use a password manager. They keep reusing the same passwords on multiple websites, which is a serious security risk. 2/ If the user uses an email server that doesn't support STARTTLS, then theoretically an attacker could request a password reset and "catch" the unencrypted email. My conclusion: Passwordless login is an interesting solution. But there are other issues to consider, discussed in other comments (email delivery latency/greylisting, ergonomy, need to remember which email address you used, etc.).
  - rhubarbquid 9y ago
    > Just use the GMail to avoid the delay with fetching third party accounts. "Don't use the email client you prefer" isn't really a great argument against it being bad UX...
    - ngrilly 9y ago
stephenr 9y ago
why would they? It's less secure, and less usable.
cuu508 9y ago
> Type your email -- receive the code -- fill in the code Many services actually do support this. It's under "Forgot Password..." link when signing in ;-)
- shanecleveland 9y ago
  Exactly. I choose to forget my password in many cases.
antaviana 9y ago
Email deliverabilty is not necessarily 100%. Also there can be latencies here and there that can lead to user frustration (for example greylist strategies). One alternative for password-less is to use Google Authenticator code as the password (i.e. send the QR code once by email and from then on use the Google Authenticator code), but I'm not sure if the the low entropy (1/1000000th chance of guessing the right password) would be enough for brute force attacks.
cpburns2009 9y ago
Why would I want to go through the hassle of requesting a new non-password to be sent to my email, wait to receive my non-password, and then log in using that non-password every single time I want to log in? I will happily let my web-browser remember my password, or store it in a password manager if it needs to be secured.
- lewisl9029 9y ago
  Square Cash is the most prominent example I know of for an email-based passwordless login system, and I personally really like it. > then log in using that non-password every single time I want to log in? The key piece of UX in these systems is you don't make the user do this every time, but rather only when logging in on new devices, and after a reasonable expiration date, say 30 days. For the average HN user, this might not be much of an improvement in terms of security or UX compared to a regular password system when used with a good password manager. The average internet user is and always will be much less sophisticated, however, and is someone who can manage to regularly forget even their really crappy passwords (if they use more than 1 password to begin with). For the average user, I think this system improves both UX and security by a large degree because for UX, it removes the need to remember more than 1 password (the password to your email serves as your master password), and for security, it verifies identity using the ability to access an email and a device (browser) rather than the mere knowledge of an email and a password.
  - cpburns2009 9y ago
    This simply sounds like a forced password reset scheme which I don't see the benefit of. Standard passwords can accomplish exactly the same thing with the added advantage of allowing instant log-in if you remember your password.
- kkirsche 9y ago
  Certificates are used but can be a hassle cross platform. Email is insecure so I don't love that idea. Emails are plaintext moving around the internet and can be snooped on (doesn't mean they are but much easier than a TLS client to server connection
assafmo 9y ago
I think passwordless is better. webtask.io does this and it's awesome.
Scaevolus 9y ago
I think OAuth logins are a nice compromise. "Login with Google / Facebook / ..." with one click works well! Unfortunately, some sites use it to just get your email address, and still require you to make a password for them, which defeats the purpose and decreases user trust in the benefits of going through the flow.
- joshontheweb 9y ago
  This can be pretty annoying for users and developers though. If the user forgets what account they last used and selects a different one next time then it ends up creating an entirely new account unassociated with the first. If I ever do social integration, I require a plain old email based login first and then allow them to connect their social accounts to it.
  - lewisl9029 9y ago
    One way around this (from the developer's side) is to federate together different identities for a user using something like dex [1], and segregating your login and signup paths, so attempts to login will never create a separate account. [1] https://github.com/coreos/dex https://github.com/coreos/dex
nkkollaw 9y ago
I would think, because that's a nightmare versus both social login and my browser remembering both username and password..? That's way too many steps, and takes too long since many times email takes a while to get fetched—specially on mobile.
Tomte 9y ago
I liked the way The Magazine worked: they sent you a link which set a cookie.
tmnvix 9y ago
Greylisting[0] would still be a problem. Signup is exactly the situation where this would be both most likely and most inconvenient. [0] https://en.wikipedia.org/wiki/Greylisting https://en.wikipedia.org/wiki/Greylisting
ngrilly 9y ago
The main issue with passwords is that non-technical users tend to reuse the same password, which is a serious security risk. This is, in my opinion, the best reason to use a passwordless login. A better solution would be, when the user create his/her account or reset his/her password, to generate a random password, instead of letting the user choose a password. I'm curious about this approach. As anyone tried something similar?
theandrewbailey 9y ago
It's exchanging one authentication factor (something you know) with another (something you have), while negatively impacting UX (by adding email UX issues) and not adding meaningful security.
mattbgates 9y ago
While passwords are still my preferred method, I was trying to think about ways to incorporate a passwordless system. I like the method that Slack has.. while they offer the old method of logging in with a password, their other method is to send your email a link and then once that link is clicked, they set a cookie indefinitely. The other way is once a user registers for an account, they get an email to login, but before they can login, they have to enter in their phone number, so then from then on out, every time they enter in their email, they will get sent a text message and simply have to enter in a code. It is still not technically passwordless, but it certainly is a unique method to have people login. No matter how far we come though, the username and password seem to still be our best method of knowing WHO YOU ARE and verifying the account belongs to you.
marssaxman 9y ago
That's just the "forgot password" system, minus the convenient option of entering a password instead of waiting... and waiting... and waiting... and checking your spam folder... and waiting some more... for the email with the auth code to arrive. Not actually an advantage, in my eyes.
formula_ninguna 9y ago
they are - unaware of it - lazy to make a change I use passwordless login at, for example, my website https://playforitsownsake.com https://playforitsownsake.com and I don't have to request a password that every single time I go there because a login lasts for 2 weeks.
zzo38computer 9y ago
I don't like those "login with Google / Facebook / etc", nor that "Type your email -- receive the code -- fill in the code". OpenID would be better I think. You can design it to use something other than a password for authentication if you want to; it mean the authentication system can be independent from whatever you log in to.
Lan 9y ago
Consider the three most common authentication factors: * Something you know * Something you have * Something you are A conventional password-based login implements "something you know" (i.e. your password). A password-less login implements "something you have" (e.g. email access). That doesn't make it more secure, it's just substituting one authentication factor for another. One could argue that it's more convenient but that's subjective since people that use password lockers might actually find it less convenient. An argument against password-less logins might be that they should be implementing multi-factor authentication in the first place. Password-less login is by nature not at least two-factor authentication. Even if you have two-factor authentication enabled for your email, it will still just be "something you have" because someone that gains access to your PC or phone will probably have access to your email as well. The easiest second factor to add into the mix is "something you know" (e.g. a password) and now you're back to conventional two-factor authentication practices.

22 points by ivanpashenko 9y ago

Is there a reason why new services are not using passwordless login? (Type your email -- receive the code -- fill in the code)

lwlml 9y ago

It is a cultural problem. I think the "younger" users don't use e-mail as much as they do other forms of "Internet" e.g. Facebook for authentication. Otherwise, I'm loathe to give out my e-mail address because of spamming and data-collection.

deleted 9y ago

[deleted]

pavel_lishin 9y ago

As a consumer of services, it's not more convenient for me than clicking the Lastpass (or your password manager of choice) icon and filling in the login form. Plus, I imagine some people may have multiple email accounts, and would have to hunt through them to figure out which one they used to sign up with. (Similar to my problem with StackOverflow; I can never remember which identity provider I used to sign up with them, and end up just clicking on all of them in order until one lets me in. For all I know, I might have multiple accounts.)

shanecleveland 9y ago
Not saying your are wrong in your preference, but you can similarly use a password manager to save the email address used for a password-less login. So perhaps not a good argument against passwordless logins in general, though I am sure there are many good reasons against it. So far, the few arguments against here are individual, convenience-based reasons. Those are certainly valid reasons, because if you inconvenience a potential user, they may never become an actual user. Not everyone has a password manager, and many people use the same username, email and password across many services. The larger danger can be that if one service is hacked, it may provide a hacker access to many services, including email. A provider of a service with a passwordless login would never have to worry about being the root cause of such a breach. And, as long as the users' email was not hacked, would not be susceptible to malicious activity through another hacked service. One question for the OP: What kind of service are we talking about? If the information is sensitive, then perhaps it is not a good idea. If it would be safe to keep a user logged-in after a session ends, then maybe a good consideration. By limiting the number of login requests, then you reduce the inconvenience.
- pavel_lishin 9y ago
  > you can similarly use a password manager to save the email address used for a password-less login Sure, but it still adds an extra step; my current manager doesn't have a "log into the email address you used to register with this site" button. But you're right, there are advantages to email-based login.
  - shanecleveland 9y ago
    You're right about that extra step, which may be crippling enough to keep users away.

BjoernKW 9y ago

Plenty, both in terms of security and UX: 1.) It's less secure (unless the email is encrypted, which in most cases it is not). 2.) If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email. 3.) Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the purpose for the operator to have a less complex authentication system to worry about).

ngrilly 9y ago
> It's less secure (unless the email is encrypted, which in most cases it is not) I disagree. With opportunistic encryption, if the recipient' server supports STARTTLS, then the communication between the sender' server and the recipient' server is encrypted using TLS. Nowadays, all major email service providers support STARTTLS. > If you use GMail with several accounts and POP3 you'll have to wait until GMail sees fit to fetch the email. Just use the GMail to avoid the delay with fetching third party accounts. > Password managers provide both a superior UX and superior security. So, by all means at least provide a password-based login as an alternative (which admittedly defeats the purpose for the operator to have a less complex authentication system to worry about). I mostly agree, but: 1/ Alas, most users don't use a password manager. They keep reusing the same passwords on multiple websites, which is a serious security risk. 2/ If the user uses an email server that doesn't support STARTTLS, then theoretically an attacker could request a password reset and "catch" the unencrypted email. My conclusion: Passwordless login is an interesting solution. But there are other issues to consider, discussed in other comments (email delivery latency/greylisting, ergonomy, need to remember which email address you used, etc.).
- rhubarbquid 9y ago
  > Just use the GMail to avoid the delay with fetching third party accounts. "Don't use the email client you prefer" isn't really a great argument against it being bad UX...
  - ngrilly 9y ago

stephenr 9y ago

why would they? It's less secure, and less usable.

cuu508 9y ago

> Type your email -- receive the code -- fill in the code Many services actually do support this. It's under "Forgot Password..." link when signing in ;-)

shanecleveland 9y ago
Exactly. I choose to forget my password in many cases.

antaviana 9y ago

Email deliverabilty is not necessarily 100%. Also there can be latencies here and there that can lead to user frustration (for example greylist strategies). One alternative for password-less is to use Google Authenticator code as the password (i.e. send the QR code once by email and from then on use the Google Authenticator code), but I'm not sure if the the low entropy (1/1000000th chance of guessing the right password) would be enough for brute force attacks.

cpburns2009 9y ago

Why would I want to go through the hassle of requesting a new non-password to be sent to my email, wait to receive my non-password, and then log in using that non-password every single time I want to log in? I will happily let my web-browser remember my password, or store it in a password manager if it needs to be secured.

lewisl9029 9y ago
Square Cash is the most prominent example I know of for an email-based passwordless login system, and I personally really like it. > then log in using that non-password every single time I want to log in? The key piece of UX in these systems is you don't make the user do this every time, but rather only when logging in on new devices, and after a reasonable expiration date, say 30 days. For the average HN user, this might not be much of an improvement in terms of security or UX compared to a regular password system when used with a good password manager. The average internet user is and always will be much less sophisticated, however, and is someone who can manage to regularly forget even their really crappy passwords (if they use more than 1 password to begin with). For the average user, I think this system improves both UX and security by a large degree because for UX, it removes the need to remember more than 1 password (the password to your email serves as your master password), and for security, it verifies identity using the ability to access an email and a device (browser) rather than the mere knowledge of an email and a password.
- cpburns2009 9y ago
  This simply sounds like a forced password reset scheme which I don't see the benefit of. Standard passwords can accomplish exactly the same thing with the added advantage of allowing instant log-in if you remember your password.
kkirsche 9y ago
Certificates are used but can be a hassle cross platform. Email is insecure so I don't love that idea. Emails are plaintext moving around the internet and can be snooped on (doesn't mean they are but much easier than a TLS client to server connection

assafmo 9y ago

I think passwordless is better. webtask.io does this and it's awesome.

Scaevolus 9y ago

I think OAuth logins are a nice compromise. "Login with Google / Facebook / ..." with one click works well! Unfortunately, some sites use it to just get your email address, and still require you to make a password for them, which defeats the purpose and decreases user trust in the benefits of going through the flow.

joshontheweb 9y ago
This can be pretty annoying for users and developers though. If the user forgets what account they last used and selects a different one next time then it ends up creating an entirely new account unassociated with the first. If I ever do social integration, I require a plain old email based login first and then allow them to connect their social accounts to it.
- lewisl9029 9y ago
  One way around this (from the developer's side) is to federate together different identities for a user using something like dex [1], and segregating your login and signup paths, so attempts to login will never create a separate account. [1] https://github.com/coreos/dex https://github.com/coreos/dex

nkkollaw 9y ago

I would think, because that's a nightmare versus both social login and my browser remembering both username and password..? That's way too many steps, and takes too long since many times email takes a while to get fetched—specially on mobile.

Tomte 9y ago

I liked the way The Magazine worked: they sent you a link which set a cookie.

tmnvix 9y ago

Greylisting[0] would still be a problem. Signup is exactly the situation where this would be both most likely and most inconvenient. [0] https://en.wikipedia.org/wiki/Greylisting https://en.wikipedia.org/wiki/Greylisting

ngrilly 9y ago

The main issue with passwords is that non-technical users tend to reuse the same password, which is a serious security risk. This is, in my opinion, the best reason to use a passwordless login. A better solution would be, when the user create his/her account or reset his/her password, to generate a random password, instead of letting the user choose a password. I'm curious about this approach. As anyone tried something similar?

theandrewbailey 9y ago

It's exchanging one authentication factor (something you know) with another (something you have), while negatively impacting UX (by adding email UX issues) and not adding meaningful security.

mattbgates 9y ago

While passwords are still my preferred method, I was trying to think about ways to incorporate a passwordless system. I like the method that Slack has.. while they offer the old method of logging in with a password, their other method is to send your email a link and then once that link is clicked, they set a cookie indefinitely. The other way is once a user registers for an account, they get an email to login, but before they can login, they have to enter in their phone number, so then from then on out, every time they enter in their email, they will get sent a text message and simply have to enter in a code. It is still not technically passwordless, but it certainly is a unique method to have people login. No matter how far we come though, the username and password seem to still be our best method of knowing WHO YOU ARE and verifying the account belongs to you.

marssaxman 9y ago

That's just the "forgot password" system, minus the convenient option of entering a password instead of waiting... and waiting... and waiting... and checking your spam folder... and waiting some more... for the email with the auth code to arrive. Not actually an advantage, in my eyes.

formula_ninguna 9y ago

they are - unaware of it - lazy to make a change I use passwordless login at, for example, my website https://playforitsownsake.com https://playforitsownsake.com and I don't have to request a password that every single time I go there because a login lasts for 2 weeks.

zzo38computer 9y ago

I don't like those "login with Google / Facebook / etc", nor that "Type your email -- receive the code -- fill in the code". OpenID would be better I think. You can design it to use something other than a password for authentication if you want to; it mean the authentication system can be independent from whatever you log in to.

Lan 9y ago

Consider the three most common authentication factors: * Something you know * Something you have * Something you are A conventional password-based login implements "something you know" (i.e. your password). A password-less login implements "something you have" (e.g. email access). That doesn't make it more secure, it's just substituting one authentication factor for another. One could argue that it's more convenient but that's subjective since people that use password lockers might actually find it less convenient. An argument against password-less logins might be that they should be implementing multi-factor authentication in the first place. Password-less login is by nature not at least two-factor authentication. Even if you have two-factor authentication enabled for your email, it will still just be "something you have" because someone that gains access to your PC or phone will probably have access to your email as well. The easiest second factor to add into the mix is "something you know" (e.g. a password) and now you're back to conventional two-factor authentication practices.