Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#71

Post by skohan »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

regarding point 3, I feel like familiarity bias is such a difficult thing to overcome sometimes with UX. However poor the experience of the standard signup/auth process is, users have already learned the complexity, and the risk is super high when you're showing people a totally new type of hurdle they have to jump to access your product. Even if it's less complex objectively, if they fail the first time there's a high chance that user is never coming back.

But I think authentication in general is a problem which really needs to be solved, and in a standards-based way. For instance, with connecting to public wifi networks (i.e. at an airport), it's absurd to have to go through a web page every time to log in. Also with the proliferation of IoT devices, it's always painful to go through the process of connecting it to my bluetooth and/or wifi. There should be some kind way to handle trust systematically through my smartphone without having to manually type a bunch of passwords.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#72

Post by [deleted] »

krageon wrote: post #59
ketamine__ wrote: post #51

Earlier quoted context omitted.

I've experienced that too.

Then you haven't used it for very long. Besides that, more exists than some tech giant's gambit to gather and exploit as much user information as they can. Nobody should use gmail, unless they are forced to by their job (in which case they should try to change it if they are in a position to).

[deleted]

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#73

Post by topherhunt87 »

Tried this recently on a small SaaS app; users complained nonstop about the inconvenience of having to switch to their email client. One key thing I overlooked is that the service is often used in academic presentation situations, where you're trying to log into the service on a 10-year-old lectern computer where you aren't logged into your email account. I reverted to the generic UN/PW approach and the complaints disappeared; passwords aren't perfect, but at least they're compatible with sticky notes. Plus, users prefer the familiar.

I won't try the one-time-link approach again unless the app's specific use case makes passwords extra painful.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#74

Post by [deleted] »

CuriousCosmic wrote: post #64
ketamine__ wrote: post #51

Earlier quoted context omitted.

I've experienced that too.

The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user. This usually happens because whatever service the site is using to handle sending out emails is under heavy load, having issues, or is rate limiting the site due to a s…

[deleted]

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#75

Post by hnlmorg »

squiggleblaz wrote: post #70
hnlmorg wrote: post #65

Earlier quoted context omitted.

I'm not going to defend passwords, they are a usability nightmare. But I'm yet to see a solution that consistently works better. Regarding your problems, it sounds like you're in need of a better password manager. I personally use LastPass. I'm not saying it's the best out there but I've been using it for a few years and haven't felt the need to jump ship yet. The advantage of having a 3rd party password manage is th…

I can run the builtin Firefox password manager on my phone, tablet, laptop and any browsers I want :p It would just be nice if it supported password generation where I need it most.

Which just emphasises my point that you need a better password manager which does support password generation on every device. LastPass being one such example.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#76

Post by [deleted] »

ketamine__ wrote: post #51
krageon wrote: post #48

Earlier quoted context omitted.

From a user standpoint the delivery latency is really what kills it for me. I use one or two websites that still have one-time sign in links and it's always a tossup whether or not I can actually get in within a few minutes. If the email arrives an hour later I've moved on with my life and I can't imagine it is any different for other people.

I've experienced that too.

[deleted]

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#78

Post by usrusr »

squiggleblaz wrote: post #50
GTP wrote: post #10

From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories: 1) Something you know (e.g. a password) 2) Something you have (e.g. a token) 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...) Real OTPs fall in the second category, because you have some device/application that is able to generate the same O…

Every system that relies on passwords also provides a password reset facility. The facility typically sends a token to your email address and allows you to set your password that way. Doesn't this mean that a system which relies on an token sent to you is no worse that a system with a password? With a password, you can guess that GTP used the same password on Hacker News and BigBank, and if that fails, you can try an…

The difference is that the password works as a shortcut for situations where the email approach adds lots of friction (working on a "guest" device, latency, the entire world spam countermeasures). Friction is very much acceptable for password recovery (arguably even desirable), but not so much for conventional login.

A nice middle ground would be allowing to opt out of passwords, for people who are happy with the combination of device token plus email OTP. This would work even better if device tokens were not binned with all those junk cookies: I think it could be valuable to have a class of "qualified cookies" that can only be written on user prompt and have reads optionally protected by additional local authentication requirements (configured on the user prompt), basically something that sits right in the middle between the streaming heap of cookies a browser stores and the browser's password store that allegedly nobody uses. I believe that this could be a major win for web privacy, "delete all cookies except for those which the store considered important enough to depend on a user prompt" (obviously, the client needs to include a "pretend to store, but actually keep only for the session" option to prevent abuse)

You could almost implement this for a site already using the web storage API, except for the unclear client prompts and lack of fine-grained tying into additional client side authentication measures (e.g. like how you might want a password manager to maintain very different master key freshness requirements for different entries)

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#79

Post by squiggleblaz »

hnlmorg wrote: post #75
squiggleblaz wrote: post #70

Earlier quoted context omitted.

I can run the builtin Firefox password manager on my phone, tablet, laptop and any browsers I want :p It would just be nice if it supported password generation where I need it most.

Which just emphasises my point that you need a better password manager which does support password generation on every device. LastPass being one such example.

I meant my first comment in jest. I will consider your advice, but I imagine switching from one password manager to another will only certify me as a genuine and eternal password hater. (Also, a password stored in a password manager is something you have, not something you know, so it's completely inconsistent with the principle of MFA. I mean, the reasons to hate passwords just increase as long as I think about it. That probably only hurts the theory of passwords though, not the practice of them.)

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#80

Post by RulerOf »

albertgoeswoof wrote: post #21
camhart wrote: post #16

Earlier quoted context omitted.

4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.* * Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.

Dedicated IPs aren’t great because they’re completely untrusted. Better to sign up with a smaller email provider than mailgun/ses

SES warms up dedicated IPs for several weeks by using them for regular SES traffic during the warmup phase: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/dedica...
Post reply on HN