The Death of the Login
medium.com
medium.com
No, the primary use case for a login is when you need to actually authenticate to be authorized to access secure data.
But really, does anyone else find that quote eye-rollingly tech-hipsterish?
If I buy and install a piece of software like Photoshop (pre-Adobe subscription Photoshop), I don't have to login to use it. It "remembers" my settings and customizations simply by storing them in a file on my computer. There's nothing stopping an app on my phone or tablet from doing the same.
When talking about "Multi-device support" we're really talking about device synchronization. You could consider a web browser/web app as a "device" for the purposes of this discussion. Since most devices can't do peer-to-peer synchronization, we often rely on the software vendor to provide centralized services. This requires identification and security which is typically implemented with username/password credentials.
Uhh, it's not? What happens when a user upgrades their phone? Or loses it? Since the OP has basically admitted they'll fall back on logins at some point, I think they're going to have a much harder time explaining to users that they need to add an email address later in the process (or worse, try to retrieve someone's data when it's too late). On the other hand, it is interesting to think that maybe there is a decent strategy here, where you gracefully migrate an app user without a login (high conversion) into identifiable user (lower conversion).
And security, which is kind of a big deal if you have data the user would prefer be kept in their own secure space.
At that point I am easily discouraged enough to stop using it.
E.g.: this happened to me with Khan Academy. I had watched so many videos on that cookie-only session, by the time it disappeared I'd long forgotten which ones I'd seen. Feeling a little discouraged, I thought, Okay, I'll get back to Khan tomorrow. Tomorrow never came.
If more people are like that, that could be a good reason not to allow cookie-only sessions for too long.
Or am I the only one?
Do any users actually like these sorts of notifications? It's clear to me why application authors use them, but do users really like this stuff?
It is notifications like this that make it so that whenever an app asks for permission notify these days, I say no.
What et1337 means is that you never even create a password, you literally login by putting just your email in, switching to your email, and clicking the link provided.
Given that most sites require you to do this when you first create an account to prove you own the email anyway, what was the point of having a password?
I don't know whether it's sites that add outgoing e-mails to a backed-up queue, or if it's an anti-spam heuristic somewhere adding the delay, or delay on the servers of your own webmail service, or whatever combination of these, but unfortunately it's certainly not always as simple as "switch to your email app, click the link".
Fundamentally the solution to all this is that you should have a signin at least once (to get your identifier keys securely) but then every website should authenticate against your keys, not against a username and password, and it should be transparent so as long as you are logged into an "account" you have personal keys for that identity that correspond to all the other services you use.
Really, its how the desktop works, and it is how the web should work, since they are converging and all.
> The Death of XYZ that is actually not really going anywhere for most people
The death of login, gamers, angular, react, PHP, etc, etc.
A few years ago, it was "Why I quit my job, and why you should too".
Then it was "Why $social_network sucks, and why you should leave".
Every now and then, you see "Why X sucks, and why you should stop using it (alternatively: X considered harmful)".
Now it's "The death of X"
:\
But seriously, this is literally the problem that logins were designed to solve. With a login, you are defining an external concept of "user" that is distinct from the device.
Available security factors are: something you are, something you possess, something you know. Right now, you're using something you possess (the device). The problem is, if I lose the device, I've lost my security credential, and no longer "own" my account.
To fix this, you could collect an email, and when installing your app, you could prompt the user if they want to use an existing account or create another. But then, you probably want to add some security in the form of a password... and then you've created a login.
This will happen. It will happen all the time. And when it does, people will be disappointed. People will stop using your app because they lost everything. I've seen this happen.
This system can work if the data is not important. But the nature of apps that store data or have a concept of "your data is stored" needs to account for cases where the original device is no longer accessible/usable.
> So a device migration can be done.
Relying on device migration is foolish. It will fail. And I will blame your app for losing my data.