News for hackers. Stuff that matters.

A comment on RIP, Passwords. Here’s What’s Coming Next. Parent comment

Re:RIP, Passwords. Here’s What’s Coming Next by mooreds on Thursday January 19, 2023 @11:32AM (#34442160)
Hmmm. I haven't seen any hard numbers on this, but I can only think of a few sites that made me turn on MFA, and they were financial in nature. Many many sites encourage MFA, but I haven't run across too many that require it.

Can you share any details about the sites?

[ Parent | on HN ]
Re:RIP, Passwords. Here’s What’s Coming Next by hendersoon on Thursday January 19, 2023 @11:37AM (#34442227)
It's becoming increasingly common for sites to not offer password authentication at all. Instead they send you a SMS text or email with an auto-login link.

I hate this so, so much.

[ Parent | on HN ]
Re:RIP, Passwords. Here’s What’s Coming Next by gardenfelder on Thursday January 19, 2023 @11:39AM (#34442257)
Why?
[ Parent | on HN ]
Re:RIP, Passwords. Here’s What’s Coming Next by illiac786 on Thursday January 19, 2023 @11:43AM (#34442322)
It’s slows your login significantly, it’s cumbersome. The more often you have to do it, the more infuriating it becomes. Disclaimer: I hate this as well.
[ Parent | on HN ]
Re:RIP, Passwords. Here’s What’s Coming Next by chrisandchris on Thursday January 19, 2023 @12:51PM (#34443269)
Because SMS may not arrive. E-Mails may be delayed or blocked by spam filters. You may not have e-mail set up on the device you're trying to log in from - so what will you do with a link on another device?

Meanwhile, a password is something you already have at hand and works instantly.

Recently tried 3 weeks to setup Slack because it's magic mail did not arrive. Was even unable to reset the password. We just gave up and used another e-mail service provider and created a ned account.

[ Parent | on HN ]
Re:RIP, Passwords. Here’s What’s Coming Next by mooreds on Thursday January 19, 2023 @12:16PM (#34442822)
I dislike that intensely as well. I don't have any trouble with sites offering magic link login, but to have that be the only option seems short sighted to me.

I worked at a company once that only offered federated login. It was a dev tool, so they offered login with google or github. I disliked it, because, hey, maybe I don't want to link random devtool with the core accounts I use.

I'm not aware of any research that shows what the conversion rate is for each type of login:

* username/password

* magic link

* federation (login with google, etc)

But I'd sure love to see it.

I imagine it would also vary by application type (devtools would be skewed towards username/password, consumer towards federated login or magic link) as well.

[ Parent | on HN ]