User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
As far as I've read, passwordless login like Slack uses (user inputs their email and then clicks on the login link in their email) is becoming more common and is just as secure as logins that require a password.
I am a designer at a financial technology company whose users skew older. Perhaps this type of login will feel unfamiliar to them (and thus untrustworthy) or too easy, like some secure step is missing. Has any research been done on the perceived security of this flow?
I work on security products for many years. The current product I'm working on, (mobile app to secure employees' data), uses exactly that.
In the last ~5 years that the product exists, we never heard a claim from end-users (banks, healthcare, insurance, medical) or admins, that the authentication method is not safe enough. Not sure what it says about your specific users and product though - decide yourself.
What you should not decide by yourself and be responsible for, is what authentication method to use. There are different considerations to that. Always consult a security expert.
Similar to the OP, I work in FinTech and the hip & trendy designers want "Magic Links" for login because they see them done by less security conscious (but "successful") companies like Slack.
But I urge you to think about what you are telling the users of your app: It's not only "OK" to click links in email, it's the only way to authenticate!
Encouraging people to click links in email is a mega security anti-pattern that will make them vulnerable to Phishing. When they receive a doggy email from a scammer that looks like it came from their bank, and you have trained them to click on "Magic Links", they will click it and bad things happen. 😢
A far better way of doing this that also feels more secure to both people using your app and the security auditors is a 3 step:
This has the advantage of verifying their email and not encouraging them to click arbitrary links.
Passwordless authentication is quite likely more secure than a standard password; people have little patience with traditional username/pw security, and it's almost a 2-factor authentication process. The easier for the end user your security protocols are, the more secure the authentication process is (password123 anyone?).
So...I don't know of extant research in perception, specifically, but it would be a fantastic usability test to run with your users/target audiences. Since you're working for a financial institution they have the resources to run a test on this. Or to let you do the same!
I'd love to hear if y'all do run this kind of test - it'd be great to share with the community. And quite possibly an industry-first customer experience upgrade. There's a lot of benefit to this approach IMO.
Depends to the sign-in flow design, I would argue magic-link style passwordless sign-in would be more secure than traditional username/password sign-in.
In magic-link style of authentication approach, to compromise one's login access to your web application, adversary will need to compromise victim's email account access to the extent that he can read the email from victim's at the time he going to sign-in your web application. It causes more trails and mail alert, which is harder to cover up, and victim will notices about that easier, hence more difficult to success.
However, in username/password authentication approach, adversary is possible to compromise the access totally unnoticed by user, since the adversary may bought the database dump from dark web containing the password and crack it offline. Hence it is possible that adversary can use the cracked password the login the web application without any notice to the user, and additional countermeasures will need to implement to improve the situation (e.g. a follow up email to user that he's logged in the web application).
It's fine if you Do it Right. But that doesn't mean clicking on magic links.
Google does a nice job of it. They pop a prompt up on the user's phone and say "Are you trying to log in to xyz?"
If the user says "yes", the login on the web browser goes though. If not, it doesn't.
This bases security on the fact that the user possesses their phone and has logged in to the phone (a pattern or PW or PIN is required).
All the crypto stuff is handled in a security chip (at least with Pixel phones)
