Schlomo Schapiro

Following up on A Login Security Architecture Without Passwords I recently had the opportunity to try out how easy it is to actually implement the "no password" login architecture. The problem to solve was publishing a small static website (an online conference program) to be accessible by several hundred people, of whom we only have the email address (that they used to sign up for the event). The event is private and the program should therefore also not be published to the open Internet, but stay private. In this example the conference program was a custom built website published via static website hosting. The code and more information on how to get started is published at github.com/schlomo/static-website-with-magic-link-auth Problem Analysis Magic link authentication (get a link via email to log in instead of bothering with a password) is in my humble and honest opinion the best — if not only — solution for this probl...

Following up on Lifting the Curse of Static Credentials and Eliminating the Password of Shared Accounts , I have many discussions about why we would benefit from removing password prompts for website logins. Let's dig deeper into the details and show why removing password prompts leads to a  safer security architecture . Update 11.03.2022: Added more details about business vs. consumer websites and additional security suggestions surrounding WebAuthn Problem Space For context, imagine a website that needs to identify online users via their email address. We assume that the website in question is not the primary email system of a user but some other website, e.g. an e-commerce shop system or a collaborative productivity tool. As a User As a user of that website I want to easily sign up for an account have an easy way to login into the account be sure that my account is protected from others or attacks be able to easily recover access to my acco...

Update 30.11.2020: Explain why I removed the print buttons from my blog. Many websites look great on screen but don't support printing or don't look good on paper. Mostly this is because the website designer "forgot" to test and optimize for printing. To help with this problem, there are free services that can print any website. I know and use two such services: PrintFriendly and PrintWhatYouLike . Unfortunately no service works perfectly, usually one or the other produces better looking results. Both offer adding a "print" button on your website and generate some Javascript/HTML for that. Upon closer analysis it turns out that these buttons are very much not cool from a GDPR compliance perspective: The buttons load an image and additional Javascript when your  website loads so that the people running those print services get a very nice access log of your users reading your website! To solve this problem, I modified the print buttons to be more data priv...