Sick of spending time on Auth, we built an open source 'Stripe for Auth'
For my little web app I just went with passwordless logins and did the "magic token sent to the inbox" thing. I no longer have to deal with passwords at all; a security breach is (mostly) useless in terms of mining creds; and all of the password handling workflows are now the email provider's problem.<p>If someone loses access to an email account then I can use manual processes to verify the person and change the email address in the database. This has never happened.<p>EDIT: "fault" => "problem"