you don't have to use your real email for everything, even google has forwarding addresses.
and apple has private/forwarding emails as well, so this is a moot point.
I've even used G Mail's forwarding email for 6 years and I've never been hacked.
If you're concerned about this just use a fake email.
But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple.
So are you saying I can be hacked through this way, please provide evidence of this happening in a real world passwordless scenario.
> An individual can mitigate them, but they still exist
Again, I would be more convinced of real world evidence and statistics rather than theorising.
I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues. Not every user is going to do that and theyre gonna blame you when they get hacked.
> Again, I would be more convinced of real world evidence and statistics rather than theorising.
You first. You made the initial claim that passwordless login has no security issues. Systems should be assumed insecure unless proven otherwise.
Like what? you keep saying "still has security issues", but you don't give any real world examples. Just saying "still has security issues" is not a good argument.
> You first.
Lots of companies use this method in the real world, Slack, Medium, Freetrade, Substack, Monzo (a bank) and many more.
If a bank and a stock trading app is comfortable using this method, I am sure they are comfortable with the security of this method.
In addition, I already have given examples in this thread which you willingly choose to ignore.
Your turn, start with this:
> Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.
Proof?
The point is that doing auth properly is hard. Sending an email might be easy, but creating and managing the session in a secure fashion is hard, even if you’re “just doing passwordless email auth”.
uh, yes?
> The point is that doing auth properly is hard...
it works just like password reset no?
there's not much state with passwordless email auth as opposed to passwords.
I don't think I understand exactly what your argument is.
> Sure, because “do passwordless emails” is just a snap of the finger away, right?
And I showed it literally is.
The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all.
I've done these type of systems before at scale and it took minutes to do (works just like a password reset mechanism) and it is very trivial.
In your original comment above, I think you are projecting this a bit too much.
Next Comment: Because they are better at security
Your comment: Or you can do passwordless yourself and have no security problems
Next comment: You can't just do passwordless with a snap of the finger
Your comment: Yeah just use a 3rd party
You're incorrect about the thread
> The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all.
It doesn't matter if it's a 3rd party, it is still an option that exists "a snap of the finger away", which was my response to that comment, this type of system can be done in an hour, 3rd party or library.
But if you want to speed things up, then there's your solution.
That was the point, but go ahead and try and reduce and spin this to your own interpretation.
Because Auth0 and other providers have security experts specializing in prevent hacking attempts and there is no way you can do a better job than them unless you make it your full time job.