Re:Simple passwordless authentication for web projects
by Tagbert on Tuesday February 22, 2022 @01:57PM
(#30431976)
It’s great if that is an option for you, but for many of us, if a site requires email logins, it is a fail. Much of the time, by the time the authentication email arrives, the login timeout has expired.
Re:Simple passwordless authentication for web projects
by nickjj on Tuesday February 22, 2022 @03:55PM
(#30433635)
If a site makes it time out after 5-10 minutes that's on them.
An hour should be ample time for it to be delivered while offering a decent amount of security around token availability, especially since it should be revoked as soon as it's been used once.
Personally I have my email password remembered, I don't sync anything between my workstation and phone such as browser accounts or anything like that.
All I know is, logging into a site using a magic link on a phone for me is much easier since all I have to do is check my email and click a link instead of typing a ~50 character randomly generated password that I made on my workstation when using the site originally.
If someone already has access to my email then it's game over.