> no password, ever. we email a code that works once and expires in ten minutes.
Why? What's so horrible about passwords? They work so well with password managers.
I hate this forced email sign-in bullshit that's spreading like covid.
I've gone the opposite route with my recent project, using IRC-style nick + pass, with no email. I prefer this to associating everything with a unique identifier about myself.
oh, i've disliked passwords for my entire career i think:
1. everyone uses the same string
2. if they don't use the same string, they forget which password goes to which site, which is really frustrating
3. if they do use the same string, someone guesses it and the user feels 'hacked'
4. what's up with magic words proving identity anyways?
i personally feel like your computer should know who you are and then pass along that identity to the website, and passkeys get close to this (which i haven't implemented quite yet here)