You might not need to store (plaintext) emails

Re:You might not need to store (plaintext) emails by throwaway015089 on Monday November 02, 2020 @02:48PM (#24972321)

1) you can hash together email + randomsalt + password and then store randomsalt and the hashed value

2) you avoid passwords altogether by giving a user an authentication token to be saved as a bookmark perhaps? The token contains a cryptographic signature

[ Parent | on HN ]

Re:You might not need to store (plaintext) emails by spartanatreyu on Monday November 02, 2020 @06:27PM (#24974685)

For 1), How would password resets work? Wouldn't you need more than just their email?

For 2), This sounds like a bad idea for anyone sharing their screen, they could broadcast the url or even just share a link not understanding how it works and lose control of their own account. Also this would only work for users who use bookmarks.

[ Parent | on HN ]

Re:You might not need to store (plaintext) emails by throwaway015089 on Thursday November 05, 2020 @07:15AM (#24997555)

1) A new password is accepted using an email validation and the previous hash is replaced

2) The url with token is used only for logging in and the user is forwarded to the home, just like the email confirmation links in emails

[ Parent | on HN ]