Login and Password? This is so 2000s. Modern authentication has evolved to be invisible, magical, and secure. Big apps like WhatsApp, Uber and Nubank have set a new standard of user expectations.
In this article, we'll look at real-world examples of authentication flows that work and explain why they're effective.
Example 1: WhatsApp (Passwordless / OTP)
How it works: You enter your phone number. Receive an SMS with a code. Enter the code. Entered. Why it's good:
- No Password: Nobody forgets their own phone number. Nobody needs to remember a password.
- Real Verification: Ensures that the user is a real person with an active line (reduces bots). Lesson: For mobile apps, the phone number is the best identifier, not the email.
Example 2: Slack (Magic Link)
How it works: You enter your email. Slack says, "We sent you a magic link." You open the email, click on the "Confirm Email" button and the app opens while logged in. Why it's good:
- Zero Friction: No need to enter a 6-digit code. Just click.
- Security: Access to email proves identity. Lesson: Magic Links are great for B2B or Desktop apps.
Example 3: Nubank (Biometrics + Device Authorization)
How it works: You enter your CPF and app password (8 digits). The app asks for your FaceID. If it's a new cell phone, it asks you to authorize via email or facial recognition (Liveness Check). Why it's good:
- Layers of Risk: Simple login allows you to view your balance. To transfer money (high risk), requires FaceID and device authorization. Lesson: Adapt the friction to the risk of the action. View balance = Easy. Moving money = Difficult.
Example 4: Google (Sign-In with Google / Passkeys)
How it works: The operating system asks: "Do you want to use your saved Google account?" You tap "Yes." Why it's good:
- One Click: It's literally one touch on the screen.
- Passkeys: The new technology that replaces passwords with cryptographic keys on the device. This is the future. Lesson: Always offer Social Login. It is the path of least resistance.
Conclusion
Don't force your user to create a password with "8 characters, a capital letter, a number and a symbol" if it is not strictly necessary. Look at these examples. The secret is to remove the cognitive barrier. The less the user has to think to enter, the faster they start using your product.
Also read
- Authentication in Applications - Best Practices with Checklist
- OAuth: what it is, use cases and a quick guide to understand it at once
- Application Authentication: Complete Security and UX Guide
- Social Login in Applications: Implementation and Best Practices
- Social login in applications: planning with examples of what works and what goes wrong
- Application Architecture - Best Practices for Enterprises