Life after passwords

There has been quite a bit of discussion in the web development universe lately about how to fix the current crappy state of passwords. Even good methods of encryption are not enough to keep hackers from stealing passwords by the thousands from web services. Almost monthly there is some new huge data breach with thousands or millions of user records stolen.

With Little Lexicon I chose to use a no-password security scheme. The main reason is that I think that my target audience, parents, would really appreciate a simplification in their lives. I could have used a Facebook or Twitter login as well, but I'm not so keen on giving those services access to the data in my app. Privacy is a big deal to me.

Think about it. You either have one password for every service you use online (really really insecure), or you have a different one for each and are constantly forgetting them. When you go through the "I forgot my password" process, you are actually doing exactly what a no-password system does from the beginning.

So how does it work?
Basically you login to Little Lexicon by entering your email address in the login box on the home page just like any other website. Except instead of asking you for a password, it sends a secure email to your private email address. In the mail is a token and a link. You can either paste the token into the form on the website, or just click the link.

Once you are logged, in a cookie is created in your browser which lets the site identify you on subsequent visits. The cookie also has an expiration date, which we set to be 30 days after you initially login. After that time has passed you will need to login again. You can also manually logout by clicking a link on the webpage.

And why is it better?
Basically we use your email address, and your being able to access your mail as a proof of identity. It means that the only data we have about you in our database is your email address. Even if someone were to hack into our system and steal our data, they would not be able to access your account because in order to do that they would also need to have access to your personal email.

Some people argue that it is a hassle to need to have your mail open each time you want to login. I buy that as a valid argument. However since you are logged in for a month, this doesn't happen all the time. Also, how often are you not browsing with 10 tabs open, or with your smartphone quick at hand with email push notifications?

All in all I think that it's an interesting shift in a use pattern that we take for granted. Maybe it's just time for that to change.

If you're curious to read more about why passwords are not very secure, here are some articles.

Passwords are Obsolete 

Forget your passwords, please

Let's boycott passwords

Trust without passwords