Skip to main content
User Experience

Return to Answer

Clarifying the different between keeping login and keeping token.
Source Link
Björn Larsson
Björn Larsson
  • 628
  • 5
  • 6

No passwords! At all!

I would like to add to previous, excellent answers that it's possible to create a login-site which neither demands nor store passwords.

Use case

This is what it would look like when the user wants to login on a password-less site...

  1. The user enters his/her email adress.
  2. An email with a login link is sent (much like when one resets a password on a traditional site).
  3. The user follows the link.
  4. The website uses the login token in the link to login the user.
  5. The loginuser is rememberedkept logged in for X days. The login link expires after a few minutes.
  6. After X days the user is automatically logged out and need to login again.

Basically a "Reset password" function used as login.

Pros

  • No password for the user to remember.
  • No password stored in the server that can be stolen.
  • Can be combined with two-factor-authentication.

Cons

  • A new way to login which the user might not be familiar with.
  • E-mails might be delayed making a login taking longer than desired.
  • Not compatible with password managers.

Further reading

No passwords! At all!

I would like to add to previous, excellent answers that it's possible to create a login-site which neither demands nor store passwords.

Use case

This is what it would look like when the user wants to login on a password-less site...

  1. The user enters his/her email adress.
  2. An email with a login link is sent (much like when one resets a password on a traditional site).
  3. The user follows the link.
  4. The website uses the login token in the link to login the user.
  5. The login is remembered for X days.
  6. After X days the user is automatically logged out and need to login again.

Basically a "Reset password" function used as login.

Pros

  • No password for the user to remember.
  • No password stored in the server that can be stolen.
  • Can be combined with two-factor-authentication.

Cons

  • A new way to login which the user might not be familiar with.
  • E-mails might be delayed making a login taking longer than desired.
  • Not compatible with password managers.

Further reading

No passwords! At all!

I would like to add to previous, excellent answers that it's possible to create a login-site which neither demands nor store passwords.

Use case

This is what it would look like when the user wants to login on a password-less site...

  1. The user enters his/her email adress.
  2. An email with a login link is sent (much like when one resets a password on a traditional site).
  3. The user follows the link.
  4. The website uses the login token in the link to login the user.
  5. The user is kept logged in for X days. The login link expires after a few minutes.
  6. After X days the user is automatically logged out and need to login again.

Basically a "Reset password" function used as login.

Pros

  • No password for the user to remember.
  • No password stored in the server that can be stolen.
  • Can be combined with two-factor-authentication.

Cons

  • A new way to login which the user might not be familiar with.
  • E-mails might be delayed making a login taking longer than desired.
  • Not compatible with password managers.

Further reading

Added link and con about pass managers.
Source Link
Björn Larsson
Björn Larsson
  • 628
  • 5
  • 6

No passwords! At all!

I would like to add to previous, excellent answers that it's possible to create a login-site which neither demands nor store passwords.

Use case

This is what it would look like when the user wants to login on a password-less site...

  1. The user enters his/her email adress.
  2. An email with a login link is sent (much like when one resets a password on a traditional site).
  3. The user follows the link.
  4. The website uses the login token in the link to login the user.
  5. The login is remembered for X days.
  6. After X days the user is automatically logged out and need to login again.

Basically a "Reset password" function used as login.

Pros

  • No password for the user to remember.
  • No password stored in the server that can be stolen.
  • Can be combined with two-factor-authentication.

Cons

  • A new way to login which the user might not be familiar with.
  • E-mails might be delayed making a login taking longer than desired.
  • Not compatible with password managers.

Further reading

No passwords! At all!

I would like to add to previous, excellent answers that it's possible to create a login-site which neither demands nor store passwords.

Use case

This is what it would look like when the user wants to login on a password-less site...

  1. The user enters his/her email adress.
  2. An email with a login link is sent (much like when one resets a password on a traditional site).
  3. The user follows the link.
  4. The website uses the login token in the link to login the user.
  5. The login is remembered for X days.
  6. After X days the user is automatically logged out and need to login again.

Basically a "Reset password" function used as login.

Pros

  • No password for the user to remember.
  • No password stored in the server that can be stolen.
  • Can be combined with two-factor-authentication.

Cons

  • A new way to login which the user might not be familiar with.
  • E-mails might be delayed making a login taking longer than desired.

Further reading

No passwords! At all!

I would like to add to previous, excellent answers that it's possible to create a login-site which neither demands nor store passwords.

Use case

This is what it would look like when the user wants to login on a password-less site...

  1. The user enters his/her email adress.
  2. An email with a login link is sent (much like when one resets a password on a traditional site).
  3. The user follows the link.
  4. The website uses the login token in the link to login the user.
  5. The login is remembered for X days.
  6. After X days the user is automatically logged out and need to login again.

Basically a "Reset password" function used as login.

Pros

  • No password for the user to remember.
  • No password stored in the server that can be stolen.
  • Can be combined with two-factor-authentication.

Cons

  • A new way to login which the user might not be familiar with.
  • E-mails might be delayed making a login taking longer than desired.
  • Not compatible with password managers.

Further reading

Source Link
Björn Larsson
Björn Larsson
  • 628
  • 5
  • 6

No passwords! At all!

I would like to add to previous, excellent answers that it's possible to create a login-site which neither demands nor store passwords.

Use case

This is what it would look like when the user wants to login on a password-less site...

  1. The user enters his/her email adress.
  2. An email with a login link is sent (much like when one resets a password on a traditional site).
  3. The user follows the link.
  4. The website uses the login token in the link to login the user.
  5. The login is remembered for X days.
  6. After X days the user is automatically logged out and need to login again.

Basically a "Reset password" function used as login.

Pros

  • No password for the user to remember.
  • No password stored in the server that can be stolen.
  • Can be combined with two-factor-authentication.

Cons

  • A new way to login which the user might not be familiar with.
  • E-mails might be delayed making a login taking longer than desired.

Further reading