Ask HN: Why aren't one-time sign in links more popular for authentication? • Hacker News Board

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#21

Post by albertgoeswoof » Mon, Jan 04, 2021, 9:41 AM UTC

camhart wrote: post #16

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.* * Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.

Dedicated IPs aren’t great because they’re completely untrusted. Better to sign up with a smaller email provider than mailgun/ses

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#22

Post by starbugs » Mon, Jan 04, 2021, 9:43 AM UTC

albertgoeswoof wrote: post #20

starbugs wrote: post #18

Earlier quoted context omitted.

We ended up purchasing a dedicated IP from Mailgun. This solves the spam/latency problem mostly, but brings about new problems.

What other problems do you face with a dedicated IP?

You have more management work for your team. If something's wrong with it, it's mostly your problem.

I initially thought it was a "problem solved" thing by paying the money. Ended up causing us regular work (not much, but still).

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#23

Post by compsciphd » Mon, Jan 04, 2021, 9:45 AM UTC

In Israel a lot of services are tied to an SMS based OTP (including government services), so one doesn't even leave the app. the app reads the token out of the SMS and fills itself in (of course if that fails, you can still enter it manually).

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#24

Post by szundi » Mon, Jan 04, 2021, 9:46 AM UTC

So many nice insight. Thanks.

What about a use case when it is inconvenient to create another password for a new user base at a company and this way you have users without calling support all the time.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#25

Post by Brajeshwar » Mon, Jan 04, 2021, 9:50 AM UTC

Fedex have a login with an OTP via email. The OTP expires in 15min, while the email came 30+ minutes later. I exhausted the 5 tries because I keep hitting the button. I had to wait another days for an International delivery!

Imagine that.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#26

Post by jitl » Mon, Jan 04, 2021, 9:51 AM UTC

If a customer loses access to their email (because they left the job or graduated, say), in the email/password world they can log in and update the email. In the OTP world the user is screwed.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#27

Post by daveoc64 » Mon, Jan 04, 2021, 9:53 AM UTC

dewey wrote: post #19

asiando wrote: post #9

I recently used Vercel’s awesome magic link login. The feature was so awesome that I just needed to open the link in whatever browser. Unfortunately that also means that if I click the link by mistake the bad actor now has full access to my account. All just a misclick away.

> Unfortunately that also means that if I click the link by mistake the bad actor now has full access to my account. All just a misclick away Doesn’t clicking the link set cookies in your browser that then authenticate your session? How would you clicking the link somewhere give access to an attacker?

The link in the email may or may not work that way - that would be down to how the authentication system has been designed.

Some of them recognise that users aren't always signing in on the same device that their email account is set up on, so the link in the email just confirms that the login attempt is genuine.

This is similar to how Google/Apple/Microsoft/Blizzard/Steam handle login requests with their respective authenticator apps. You attempt to log in on device X (which can be anything), then confirm that the login request is genuine on device Y (your personal device).

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#28

Post by robertlagrant » Mon, Jan 04, 2021, 9:55 AM UTC

I'd rather that auth apps with a push notification prompt became more popular instead.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#29

Post by _carl_jung » Mon, Jan 04, 2021, 9:56 AM UTC

asutekku wrote: post #7

It's inconvenient. That's the primary reason why it won't gain mass adoption since any obstacle to your service will lower the registration / engagement metrics. With password managers built into all modern browsers, casual users (which, lets be honest here, are by far the most of the web users) do not have to worry about typing passwords. Security be damned. If it is not invisible to the user, they will reject it.

Password management is better, not worse, for security.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#30

Post by indymike » Mon, Jan 04, 2021, 10:00 AM UTC

Email and sms are prone to delays that make the experience bad for users.