41–44 of 44 posts
Earlier quoted context omitted.
default UI of the internet
I'm being very pedantic here in true HN fashion, but at most it's the default UI of VC-funded B2B SaaS startups. 95% of the internet-using world never comes across shadcn UIs.
Earlier quoted context omitted.
Email magic links are inconvenient for the user, but they're not dumb. They're a pretty good option for a small project by a developer doesn't want to implement a whole auth flow, or pay for an OAuth provider. It's a tradeoff. If you roll your own password flow, you need to add MFA to be secure. The complexity of what you need to build and maintain goes up. A simple magic link flow for an app like this, where you are…
The problem with magic links is that the secret is sent with each login attempt. It's just like SMS verification codes - an attacker that controls the email address, or the phone number, can log right in. In this case, probably without even resetting a password. Plus, with no way to verify the account owner other than the email address, if the email address is lost or changed, the account's as good as gone. Also yes…
This whole discussion started when @meindnoch wrote ">Sign in or create an account with your email. Into the trash it goes.".
I think magic links are acceptable for a small solo developer project. Expecting a solo developer so shoulder the burden of rolling their own auth, paying for an auth service, or self-hosting an containerised auth-service and wiring their application to it is a bit much for a tiny project like this.
Anything more than a small solo project should graduate to a better solution- I hope we can all agree with that.
Earlier quoted context omitted.
The problem with magic links is that the secret is sent with each login attempt. It's just like SMS verification codes - an attacker that controls the email address, or the phone number, can log right in. In this case, probably without even resetting a password. Plus, with no way to verify the account owner other than the email address, if the email address is lost or changed, the account's as good as gone. Also yes…
As opposed to username/password, where... An attacker that controls the email address can log right in. Unless you mean to say I should set up 2FA for my CSS theme variable helper website? Passkeys and OAuth/social login are great, but everyone has an email. And I don't think any mainstream site supports only passkey as an auth method (and no other way).
Earlier quoted context omitted.
default UI of the internet
I'm being very pedantic here in true HN fashion, but at most it's the default UI of VC-funded B2B SaaS startups. 95% of the internet-using world never comes across shadcn UIs.
There are echo chambers and availability biases, it takes a bigger person to know that they live in one.