61–70 of 198 posts
Related, I've consulted for a company that downloads and caches every link in every email passing through their corporate server.
I'm assuming you intend those links to be single-use only and expire automatically, in which case what I'm writing below doesn't apply. Nevertheless, the problem is big enough to be worth repeating and re-repeating: Any link that ends up in a browser address bar should be treated as public. And no, it doesn't matter if you use HTTPS. Ways to leak it are many, but the gist is that it's treated as "meta-data" and, righ…
How do you advise we handle email address confirmation and password resets?
No complaints with it.
Earlier quoted context omitted.
From a user standpoint the delivery latency is really what kills it for me. I use one or two websites that still have one-time sign in links and it's always a tossup whether or not I can actually get in within a few minutes. If the email arrives an hour later I've moved on with my life and I can't imagine it is any different for other people.
I've experienced that too.
This usually happens because whatever service the site is using to handle sending out emails is under heavy load, having issues, or is rate limiting the site due to a sudden spike in logins.
If this happens for any reason, it failure cascades because the more people try to log in, the longer it will take for everyone to get a valid link.
At least with a standard TOTP token or the like, if the service is under load it will eventually work if you keep trying (versus not working for longer the more people try).
Hell this method also runs into the issue of getting flagged as spam or getting blacklisted due to ~~the algorithm~~ for one reason or another. This is doubly likely if a sudden burst of traffic to a site results in them sending out a mass wave of near identical emails.
Now non-tech users can't log in at all since they "never get the email at all".
Email is a wonderful thing but it is painfully fragile and doesn't handle time sensitive stuff well at scale (due to queuing, routing issues, and spam filters).
From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories: 1) Something you know (e.g. a password) 2) Something you have (e.g. a token) 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...) Real OTPs fall in the second category, because you have some device/application that is able to generate the same O…
Every system that relies on passwords also provides a password reset facility. The facility typically sends a token to your email address and allows you to set your password that way. Doesn't this mean that a system which relies on an token sent to you is no worse that a system with a password? With a password, you can guess that GTP used the same password on Hacker News and BigBank, and if that fails, you can try an…
Regarding your problems, it sounds like you're in need of a better password manager. I personally use LastPass. I'm not saying it's the best out there but I've been using it for a few years and haven't felt the need to jump ship yet. The advantage of having a 3rd party password manage is that it can run on your phone, tablet, laptop and any browsers you want.
Earlier quoted context omitted.
From a user standpoint the delivery latency is really what kills it for me. I use one or two websites that still have one-time sign in links and it's always a tossup whether or not I can actually get in within a few minutes. If the email arrives an hour later I've moved on with my life and I can't imagine it is any different for other people.
I've experienced that too.
I mean, when you send batches of mails to gmail, it lets them through first, then depending on its whim it starts throttling or outright blocking them.
Once in a while, it changes its handling of DKIM or SPF or god knows what and the only thing you can expect from them is an SMTP error message.
Earlier quoted context omitted.
I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.
A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.
Earlier quoted context omitted.
How do you advise we handle email address confirmation and password resets?
Automatically expire the links
Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…
Email has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.
Earlier quoted context omitted.
Every system that relies on passwords also provides a password reset facility. The facility typically sends a token to your email address and allows you to set your password that way. Doesn't this mean that a system which relies on an token sent to you is no worse that a system with a password? With a password, you can guess that GTP used the same password on Hacker News and BigBank, and if that fails, you can try an…
I'm not going to defend passwords, they are a usability nightmare. But I'm yet to see a solution that consistently works better. Regarding your problems, it sounds like you're in need of a better password manager. I personally use LastPass. I'm not saying it's the best out there but I've been using it for a few years and haven't felt the need to jump ship yet. The advantage of having a 3rd party password manage is th…