you are viewing a single comment's thread
view the rest of the comments
[–] 23 points 2 weeks ago (5 children)

I agree the passkey user experience needs work, but man do I enjoy it over the haphazard 'passwordless' website login that just sends you an email.

I get it, they're just skipping an attack vector and basically relying only on '2FA'. But now I have to go to a different app/tab, copy a code, and return to the site instead of letting the password manager fill stuff in for me. Some, like kickstarter, let you still have a 2FA code enabled so you have to grab your code from whichever authenticator and go to your email. Really nice login experience out of nowhere one day. \s

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 2 weeks ago (4 children)

    The best implementation of this I've seen has to be Ghost, an open source self-hostable newsletter/patreon thing. They detect what email provider you have and when you enter your email, will display a link to open your inbox. It's super neat, and I haven't seen it anywhere else, and I'm also not sure how they do it. For something self-hostable, I'll definitely take one less attack vector.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 2 weeks ago (1 child)

    A DNS lookup on a domain says who runs the email server for email users on that domain (that's how email senders figures out how to send you messages), and if that host is a known one then you can just pull the link to show. If you're self hosting email then a few solutions can be recognized and login shown by guessing that the email software's default URL pattern is used.

  • source
  • parent
  • hideshow 1 child comment