below is taken from my post on our l0tt0 review page- i just wanted to post it here to get some input. BTW- I'll have the new homepage live next week.
so i hate passwords. i was building the registration system and kept asking myself the magic question: do i need this? what i was left with was the current one-time login link. login passwords are only as secure as your email password (pw resets). i totally get the issue of the one-time login link with regards to different devices, not everyone wants to play on the device they have their email on. so i do have some solutions for that and for securing the account more with 2FA.
For me, I see no issue with the current registration/login system, but it's also a good thing that you are thinking of creating a system that make provison for those who are playing with a phone or computer that they don't have their email account on, my opinion on this is below.
a) i have a version of the login page that sends a 6 digit number to be entered into the login page after you submit your email. do you think i should offer this as another option, or just make it the main login system, instead of the one-time link?
Make the sending of six digit login pin as an option alongside the sending of one time login link.
That is for example, when ever I enter my email address on the site to register/login, the system will send me both a six digit login pin and a one time login link, it's up to me to chose which of those I wanna make use of.
I think one crypto exchange I am using has that feature where they send both a one time link and a six digit pin in one email message, the user chooses which one he or she wants to make use of.
b) when it comes to 2FA i'm leaning towards a withdrawal pin; which will be created when you login for the first time. the pin will be needed for any withdrawal. i feel this is a better solution that asking for more info like a users phone- which brings in outside tech for sending txts.
what are your thoughts on this?
Josh
I honestly think a Google 2fa will be better, but on the other hand, making the two available for use, that is, a withdrawal pin and a Google 2fa, will simply be the best, google 2fa doesn't or won't require you asking users for their phone numbers.
So, for a top notch security, make both a withdrawal pin available and a Google 2fa available as well, the two will help just incase a user forgets his or her withdrawal pin and wants to reset it, reseting will require the user to enter both a code sent to their email address and a code from their Google 2fa, this will prevent scammers or hackers from stealing a user's account and reseting their withdrawal pin easily.