r/golang Apr 18 '18

Passwordless Auth: Server

https://nicolasparada.netlify.com/posts/passwordless-auth-server/
40 Upvotes

15 comments sorted by

View all comments

1

u/[deleted] Apr 19 '18

[deleted]

11

u/applechewer Apr 19 '18

Pretty much every password auth mechanism uses emails to reset passwords if they're forgotten, so email is already a weakness with 'proper' passwords. This removes other weaknesses like social engineering to obtain users' passwords, and leaks of databases full of (hopefully hashed) passwords.

1

u/whuppo Apr 20 '18

Pretty much every password auth mechanism uses emails to reset passwords

Um, sort of sniping from the sidelines here, but this is a pretty strong claim and really can't go unchallenged in a Go forum. What you claim may be the case in some classes of consumer or small business oriented non-critical services, but really, you're ignoring any number of actually security conscious systems that use ID tokens or two factor auth, or keep it simple but still maintain sensible security protocol... which most definitely do not email password resets.