Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#41

Post by radu_floricica »

I'm assuming you intend those links to be single-use only and expire automatically, in which case what I'm writing below doesn't apply. Nevertheless, the problem is big enough to be worth repeating and re-repeating:

Any link that ends up in a browser address bar should be treated as public.

And no, it doesn't matter if you use HTTPS. Ways to leak it are many, but the gist is that it's treated as "meta-data" and, rightly or wrongly, subject to much lower expectations of privacy. A recent scandal was that several common browser extensions collect this meta-data and sell it to marketing companies.

Which marketing companies offer searchable subscriptions (for hefty prices, true, this isn't a $9.99 service), where somebody could for example search for "yourcompany.com", or even worse, "yourcompany.com/authernticate?token=". Yeah, meta-data.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#42

Post by wruza »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

>sign up/sign in

Why were clear terms like login/register/logout replaced with a “sign ...”? I get confused twice a week by these, especially because the difference between “in” and “up” is so subtle (and overloaded, like “sign up for a meeting at friday”, unrelated to registration routine). Sorry for offtopic, but it is really annoying. Is it more linguistically correct or just a hipster thing?

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#43

Post by _jplc »

Email sometimes takes too much to be received by the user, but the approach could be handy in other contexts.

For example, some time ago made a Slack bot with a web dashboard. The authentication method was based on introducing your Slack username and the bot would send you an OTP. The latency problem didn’t exist here.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#44

Post by Nemo157 »

innocenat wrote: post #14
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.

A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#45

Post by wruza »

jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

Why can all instant messengers do this “instant” part and email cannot? I’m aware of mta chains, decentralization, etc, but heck.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#46

Post by Someone »

wruza wrote: post #45
jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

Why can all instant messengers do this “instant” part and email cannot? I’m aware of mta chains, decentralization, etc, but heck.

Because, as jwr says, it was never meant to be. The mental model is that of regular mail that gets collected at post offices, then split by major destination, sent on, and finally ends up in a mailbox.

Mail servers do not even have to be on the internet (https://en.wikipedia.org/wiki/Non-Internet_email_address), or on a network at all. It was fairly normal to have a time sharing system dial in to a mail server every day for a few minutes to exchange mail messages (https://en.wikipedia.org/wiki/UUCP#Mail_routing))

Also, of course, it is harder to accomplish in a decentralized system that isn’t controlled by a single party.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#47

Post by samb1729 »

wruza wrote: post #42
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

>sign up/sign in Why were clear terms like login/register/logout replaced with a “sign ...”? I get confused twice a week by these, especially because the difference between “in” and “up” is so subtle (and overloaded, like “sign up for a meeting at friday”, unrelated to registration routine). Sorry for offtopic, but it is really annoying. Is it more linguistically correct or just a hipster thing?

I'm not sure they were ever replaced; the terms co-exist. I believe the terms all stem from the general concept of writing a name on a piece of paper.

To "register" your interest in an something, you might sign a piece of paper, or instruct a person to "sign [you] up".

To show that you entered a physical event, you would sign an entry log on a piece of paper, then having "logged in" or "signed in", and then do the opposite on your way out.

Similarly you might refer to reproducing your physical signature as having "authenticated" yourself, if there's something to compare it to.

What makes one particular set of terms the right set given the apparent origins?

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#48

Post by krageon »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

From a user standpoint the delivery latency is really what kills it for me. I use one or two websites that still have one-time sign in links and it's always a tossup whether or not I can actually get in within a few minutes. If the email arrives an hour later I've moved on with my life and I can't imagine it is any different for other people.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#49

Post by szszrk »

Nemo157 wrote: post #44
innocenat wrote: post #14

Earlier quoted context omitted.

I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.

A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.

That's kind off what Microsoft does in Microsoft Authenticator. It doesn't ask for password, it sends notification to you phone app and asks you to tap "65". The app then shows 3 numbers, one is 65. You log in on the other device after tapping. No passwords entered at all.

They did a nice job on that one.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#50

Post by squiggleblaz »

GTP wrote: post #10

From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories: 1) Something you know (e.g. a password) 2) Something you have (e.g. a token) 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...) Real OTPs fall in the second category, because you have some device/application that is able to generate the same O…

Every system that relies on passwords also provides a password reset facility. The facility typically sends a token to your email address and allows you to set your password that way.

Doesn't this mean that a system which relies on an token sent to you is no worse that a system with a password? With a password, you can guess that GTP used the same password on Hacker News and BigBank, and if that fails, you can try and have their token redirected to you. Without a password, you have to rely on getting that token. So if your argument is that email and SMS are insecure channels, I mean yeah okay; but it doesn't make a system more secure if you can get in with a password _or_ an email/SMS vs the only option is an email/SMS.

I hate passwords; my password manager (the one built into Firefox) will generate passwords on my desktop, but most of the time I need to generate a password it's on my phone (where, oddly, they have not included the capacity to generate a password). So my password is crap, perhaps not stored, and I forget it. I rely entirely on the password reset facility. But most of the time if you tell me "please just sign up, think of a unique username and a secure password" I'm just not going to bother.

Post reply on HN