Export functionality for authentication cookie

[dnnr]

The current automagic authentication (implicit creation of authentication cookies, no explicit passwords) is probably fine for many use-cases. It could be enhanced by allowing the users to export their authentication token to other browsers. For mobile devices, a QR code could be used.

For some minimal security, the token transmission should only work once per generated transmission code/link.

[noyainrain]

Good idea.

Another problem we face is how to re-login on the same device (say when the authentication token is lost / removed by the browser) without introducing passwords. At the moment, my favorite solution would be to send an onetime authentication token to the user's email address. However, I've not come up with an intuitive UI flow yet.

Maybe both problems could be solved by a single approach. Further suggestions very welcome ;) .

[noyainrain]

Depends on #132 .

[dnnr]

Mailing a ready-to-use recovery link to the user right when they submit their address, just in case they need it at any point in the future, wouldn't make much sense to me. I'd even suspect that people rather lose track of an email sent to them a long time ago than a cookie given to their browser.

So, UI-wise, I'd consider two seperate flows for "hey, let me use another device rigtht now!" and "hey, make sure my account is safe". Both dialogs can share data (i.e., offer to use the already stored address to send an export token to, and vice versa), but ultimately, they solve two entirely different problems for the user, even though they are similar in their implementation. Additionally, setting up an account recovery method should maybe even be actively (but discreetly) advertised for, to any users who haven't done so already.