Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#171

Post by nwienert »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

One more: Gmail app on iPhone forces you to open links within the app, meaning you can’t actually login with Safari proper (the session/cookies aren’t shared).

Super frustrating, and something Apple should clamp down on (any app that opens web links needs to provide a full “open in Safari” option that isn’t an in-app browser).

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#172

Post by ngrilly »

swiley wrote: post #102
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

One more issue is if you're using eg microsofts webmail (office? hotmail? I'm not sure what it's called but my university had it) the links will get queried automatically to "scan them for viruses" which tends to expire them.

I ran exactly into this problem with linear.app (which uses passwordless login with "magic" links) and Outlook / Office 365. Only solution has been to ask linear.app to disable the links for our account and keep only the one-time code that we manually copy-paste.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#174

Post by shaicoleman »

The biggest downside is email isn't reliable - it's slow, it gets filtered, and sometimes it doesn't get delivered at all.

For example, I've been locked out of my Patreon account for the last couple of weeks since Gmail decided to return 550 errors (address doesn't exist) [1] and they require an email to log in when the IP address changes. Most likely my email address has been added to the suppression/bounce list of Mailgun.

* https://news.ycombinator.com/item?id=25435916

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#175

Post by leesalminen »

CuriousCosmic wrote: post #166
gog wrote: post #159

Earlier quoted context omitted.

Thank you. I've checked my logs and everything looks normal on my end and I do suppose it is some kind of tarpitting, but it doesn't show in the logs. I do have DKIM, strict SPF and DMARC policies, MTA-STS, SMTP TLS Reporting, latest TLS support and valid certificates, there is nothing else I can do on my end.

One other thing you might be able to try is to try reaching out to Google about it if it's a consistent issue. There is a contact form floating around somewhere for mail server operators to reach out to the GMail infra team about this kind of thing but IDK where it is or if they even still check it. I wouldn't put to much faith in it though, particularly considering Google's reputation wrt support.

It’s true, we send millions of mails per month and Google doesn’t give 2 shits about anyone’s email deliverability issue. All avenues of contact are black holes on that front regardless of how much you pay them.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#176

Post by the_arun »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

I like the implementation of https://www.fast.co/.

1. There is a dependency on speed of email delivery. May be use SMS as well?

2. Personally, I didn't find it too difficult. We run into same issue if we have MFA

3. fast.co experience is pretty clean. Give it a try

Disclaimer: I am not affiliated with fast.co

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#177

Post by hnick »

radu_floricica wrote: post #41

I'm assuming you intend those links to be single-use only and expire automatically, in which case what I'm writing below doesn't apply. Nevertheless, the problem is big enough to be worth repeating and re-repeating: Any link that ends up in a browser address bar should be treated as public. And no, it doesn't matter if you use HTTPS. Ways to leak it are many, but the gist is that it's treated as "meta-data" and, righ…

I was working on an ecommerce site once and we got emails when customers left reviews/feedback. I forwarded them to customers because it was a convenient way to show their comments then follow up.

Then I noticed that some of the text was wrapped in a tokenised link to the platform managing our reviews, bypassing the login screen. Support said they could not revoke these tokens. We had to close the entire account and migrate everything.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#178

Post by ytch »

jethro_tell wrote: post #117
ytch wrote: post #91

Earlier quoted context omitted.

Is it possible to solve by some kinds of warming up? AFAIK greylist is IP-based. We can send email at regular time so all the sender IP can keep in list. But email does has many uncertainty like spam detection and others to slow the process after SMTP server receive it.

How would that work? Send an email to every customer (domain, so pick a single customer at every domain) and send them an email with a fake login, or a note that says please disregard? Aside from that being spam, it's also likely to get legit emails stuck in spam filters as people start marking them as spam. Secondly, I think most of the largest providers don't really grey list any longer. They seem to have moved to…

> Send an email to every customer (domain, so pick a single customer at every domain)

Greylist is allow/block based on sender IP, not receiving metadata, so I guess pre-send mail from the IP might help, but yes, other rules might slow down.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#179

Post by Izkata »

wruza wrote: post #42
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

>sign up/sign in Why were clear terms like login/register/logout replaced with a “sign ...”? I get confused twice a week by these, especially because the difference between “in” and “up” is so subtle (and overloaded, like “sign up for a meeting at friday”, unrelated to registration routine). Sorry for offtopic, but it is really annoying. Is it more linguistically correct or just a hipster thing?

> like “sign up for a meeting at friday”, unrelated to registration routine

Are you not registering yourself for the single meeting? Adding yourself to the list?

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#180

Post by Izkata »

Macha wrote: post #58
jiofih wrote: post #54

Earlier quoted context omitted.

Email has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.

I have both a personal G Suite domain (formerly "Google Apps For Your Domain") and my employer's G Suite account where in both cases I've experienced 5+ minute delays on a semi-frequent basis.

Our work email is gmail-hosted, and just once a few weeks ago, I received an internal email days after it was sent.
Post reply on HN