Hacker News Reader

Comment by encoderer | Hacker News Reader

Just get rid of the password and require email based magic link login.

Fine use a disposable email but the account will be wiped soon when you never log back in again.

Please no. I hate services that do this, it takes longer to jump over to email and open a link then to autofill the info with a password manager and click submit.

Password managers should start supporting this flow. Allow the password manager to read your Gmail, or for cloud-based managers log up with an @1password.com email... Not trivial technically, and maybe turning password managers into SSO providers, but that's a lucrative business in itself.

At that point we'd be better of figuring out a proper protocol that allows websites to talk to the password manager directly.

Mozilla designed a decentralized authentication protocol back in 2011 called BrowserID, which was later standardized by the IETF. IIUC, it was similar to OpenID but sites would authenticate your identity with your email service provider. Unfortunately, the protocol never gained traction.

https://en.wikipedia.org/wiki/Mozilla_Persona

Don't we already have that with WebAuthn? It should be possible for the authentication request to be directed to the password manager. Less secure than using a hardware key, but more secure than password, email, or text message authentication.

That looks like it could work, though I don't think it has a lot of support from either password managers or websites.

Something like OpenID connect?

Well, ideally without the centralized server in between.

I don't want anyone but me reading my email. I just want to use password with 2fa an we all good.

Reply on news.ycombinator.com