We need to talk about email and password auth

Email and password authentication seems like an easy and straightforward way to add a sign-up / login experience to your app. But things are not as simple as that. Watch as Rachel and Peter discuss the intricacies of what turns out to be a rather complex authentication mechanism.

Chapters:
0:00 Peter shows Rachel a login screen, but she is skeptical
2:10 Password recovery
2:57 User verification
4:57 Password strength
5:42 Password autofill
6:32 Get away from passwords

Resources:


#Firebase

[michaelklaus_de]

It's amazing to me that anybody would still *want* to use email/username & password authentication, given we have options that are not just more comfortable, but also more secure and easier to implement. I'd personally go for Google or other social SSO first, then maybe email link or phone auth. No need to go through all the hassle and by default annoy the users on the way.

"I'm not fighting the password manager" - Huge thanks for that! A lot of apps do that nowadays, that they don't even provide email password login. That's a major contributor for me to not using that service. I hate when I try to log in on a device, but then I can only receive my emails on another. I have to copy the link from the email somehow. That's not ergonomic at all, no matter what they believe.

[MaximDatskiy]

Hey! Thanks for the video! Looking forward to your talk about Sign in with Apple/Google.

[xamashee]

7:25 finally talking to us. Jennifer was amazing at explaining

[steam]

Hoping to make the MFA sample app opened in developer community soon

[erinmutchler]

I work in a public library with many people who are not particularly computer literate or don't have access to a smart phone. How can we keep our apps accessible to these folks who can't use or don't understand how to use things like 2FA or user verification?

[gradientO]

Yeah! Email and link is user friendly and secure enough

[mycloudvip]

Can the passwordless auth be used for web logins and for mobile apps as well? Please share link to docs and if it can be implemented for older hybrid apps as well. Thanks

[squirel]

Always surprising to see a Google owned channel advocating for an Apple tool ("sign in with Apple" in this case) over their own.

[KevinManda]

Can we have 2-step verification via sms?🤧 it'll make it easier for users to remember passwords + it'll make it safer

[cristiantoma]

I am working with some embedded remote sensors. Do I really need to create users/passwords for each sensor? Logic says of course. But is there a better way of doing this ? Can a sensor use a different form of authentication? Something that can be centrally controlled via Console or similar ?

[punkkabestia]

Always bit sad a Firebase video without code .... 😰