Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#181

Post by cgtyoder »

CuriousCosmic wrote: post #166
gog wrote: post #159

Earlier quoted context omitted.

Thank you. I've checked my logs and everything looks normal on my end and I do suppose it is some kind of tarpitting, but it doesn't show in the logs. I do have DKIM, strict SPF and DMARC policies, MTA-STS, SMTP TLS Reporting, latest TLS support and valid certificates, there is nothing else I can do on my end.

One other thing you might be able to try is to try reaching out to Google about it if it's a consistent issue. There is a contact form floating around somewhere for mail server operators to reach out to the GMail infra team about this kind of thing but IDK where it is or if they even still check it. I wouldn't put to much faith in it though, particularly considering Google's reputation wrt support.

lol "try reaching out to google" that was my good laugh for the day.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#182

Post by Spooky23 »

conductr wrote: post #114
CuriousCosmic wrote: post #64

Earlier quoted context omitted.

The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user. This usually happens because whatever service the site is using to handle sending out emails is under heavy load, having issues, or is rate limiting the site due to a s…

> The issue isn't with the user's email As an email layman, I don’t fully buy this, can you explain? I’ve sent emails with multiple CC’s and most get it quick while one or two people have to wait for it to hit their inbox for multiple minutes. I assume they all leave my service at same time and the delay is caused by the receiving mail server.

In addition to tarpitting, a variety of transient issues can impact mail delivery. Email is all about queues and you can run into issues where servers crash or get bogged down by large email traffic.

On business systems, sometimes DLP rules impact delivery times.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#183

Post by wdb »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

My main problem with it they seem to assume that you have an email client on the device you want to access the site. I don't have mail account setup on my iPad so I need to mess around with AirDrop or iCloud to share the code.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#184

Post by fomine3 »

fredcy wrote: post #161
swiley wrote: post #102

Earlier quoted context omitted.

One more issue is if you're using eg microsofts webmail (office? hotmail? I'm not sure what it's called but my university had it) the links will get queried automatically to "scan them for viruses" which tends to expire them.

We ran into this, where the Outlook client would scan one-time login links from SalesForce (iirc). Huge pain to work around.

It's bad but I also argue that generally GET should not change state. It seems that weirdly email is the only place that allowed GET URL to change state (like unsubscribe link).

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#185

Post by nojvek »

Wow. All the hate about email OTP. It’s an amazing feature that I use all the time. I believe slack popularized it.

Security and comfort are sometimes at opposing ends.

1) it’s unreasonable to expect people to remember so many passwords. I forget passwords all the time. Password manager isn’t that great since it doesn’t work cross device. 2) even with OTP, email is slow. Also email can distract and adds friction 3) federated auth such as google/GitHub auth is great. I usually get in in a single click.

I’d say if you want to prioritize you prolly get the best bang for buck in following order

1) federated auth - no need to store passwords, no forgot password flows. It assumes your audience is okay with google/GitHub/Twitter etc auth and has an account in one of the services.

2) email/pwd. More complications but benefit is it depends on no 3rd party.

3) one time link in email. The benefit is user doesn’t need to remember password. It does depend on email which adds some friction.

Note: you can have all 3 options and let user choose for maximum conversation. The tradeoff is more work on your side.

Life is all about tradeoffs. No one right or wrong solution.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#186

Post by colesantiago »

jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

> ...because you expired it after 5 minutes.

Just increase the time? 30 mins will do. Especially if it's only one time use.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#187

Post by krageon »

AlchemistCamp wrote: post #105
krageon wrote: post #59

Earlier quoted context omitted.

Then you haven't used it for very long. Besides that, more exists than some tech giant's gambit to gather and exploit as much user information as they can. Nobody should use gmail, unless they are forced to by their job (in which case they should try to change it if they are in a position to).

What email service do you recommend?

Any one in a privacy-friendly location. There's a ton of German providers (posteo, tutanota, mailbox.org, etc) which are always safe choices. Emphatically not Protonmail, as it makes promises it doesn't deliver on and has a very strange architecture for it's security besides.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#188

Post by UncleMeat »

elwell wrote: post #136
_carl_jung wrote: post #29

Earlier quoted context omitted.

Password management is better, not worse, for security.

What is your argument for that? That people will choose better passwords (unique and long) since they don't need to remember them? The Achille's heel of password managers is if someone accesses your computer (physically or remotely) they can probably access all your accounts. <-- and I've seen this happen (not to me)

Yes. The huge huge huge majority of credential attacks are stuffing and phishing. Unique passwords prevent stuffing. We observe that everybody reuses passwords unless they use a password manager. Password managers with auto fill can also provide some defense against phishing since they won’t auto fill.

The Achilles heel you mention matters very little since it is a very rare threat model and it would be unreliable to assume that access ends at some point rather than that the adversary simply installed some persistent malware to read all future passwords.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#189

Post by UncleMeat »

GTP wrote: post #10

From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories: 1) Something you know (e.g. a password) 2) Something you have (e.g. a token) 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...) Real OTPs fall in the second category, because you have some device/application that is able to generate the same O…

People love to complain about sim swapping but in reality phishing is far more common. TOTP that you type in loses to phishing. Having a complex and unique password for each service largely defeats sim swapping.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#190

Post by slovette »

I personally think nearly everyone here is wrong.

Working in IT with a direct day-to-day relationship with end users, passwords are the bane of all existence.

You say email delivery or sms is slow, but how often is it slow for users? Data on this? I personally have never seen a significant delay for an OTP code to either my inbox or my email (Google & Verizon). I have seen users that have an old email configured that is no longer active, but, oh, 80% of the time their cell number is a backup, so resolution is easy enough for them.

You say it’s insecure? Really? So the more than 30% of your users that have their password written either on paper on their desk (most commonly a sticky note or in a small notebook just hanging out on the paper pile) or in an unencrypted note taking app is somehow more secure?

You say it’s inconvenient? What? It can’t be more inconvenient than having to go through a password reset process once a week (which believe it or not, a TON of end users do).

Is any one actually measuring this or is this as an complete echo chamber of nerds that are good with password managers? Because I can tell you with certainty there’s a whole demographic, generation of humans out there where single token logins (backed up by multiple OTP at certain time or event trigger intervals) is BY FAR AND AWAY A BETTER WAY!

You want an example of who I think has this perfected: Affirm.com

Post reply on HN