Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#91

Post by ytch »

codethief wrote: post #83
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

> 1. Email delivery latency This is particularly true when the recipient has enabled Greylisting[0] and delivery has to be attempted multiple times (which is perfectly fine from the point of view of the RFC standards). In view of this, email delivery rather resembles real-world postal package delivery (and not so much the instantaneous delivery of, say, phone calls). [0] https://en.wikipedia.org/wiki/Greylisting_(ema…

Is it possible to solve by some kinds of warming up? AFAIK greylist is IP-based. We can send email at regular time so all the sender IP can keep in list.

But email does has many uncertainty like spam detection and others to slow the process after SMTP server receive it.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#92

Post by hnlmorg »

squiggleblaz wrote: post #79
hnlmorg wrote: post #75

Earlier quoted context omitted.

Which just emphasises my point that you need a better password manager which does support password generation on every device. LastPass being one such example.

I meant my first comment in jest. I will consider your advice, but I imagine switching from one password manager to another will only certify me as a genuine and eternal password hater. (Also, a password stored in a password manager is something you have, not something you know, so it's completely inconsistent with the principle of MFA. I mean, the reasons to hate passwords just increase as long as I think about it.…

There is another option if you wish to adhere to the principle of "something I know" and that's to generate a base64 key. eg

    SITE="www.example.com"
    SALT="passphrase"
    printf "${SALT}${SITE}" | shasum -a 512 | base64 | cut -c -25
(Though you're better off using some online tool that converts SHA 512 to base64 directly since the example above converts the ASCII string of a hex representation of the SHA 512 hash into base 64. So use that example above more as a visual representation)

This will generate a non-reversible password with an entropy of 25^64 but it is re-creatable on any system that can display a web page and the password is not stored anywhere (so it's firmly "something you know"). If the password becomes compromised then you change your salt and a new unique password will be generated. Thus you only need to memorise a small subset of salts rather than a password per site.

This was how I used to do passwords several years ago before I gave into the convenience of password managers.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#95

Post by tarun_anand »

Wow... amazing response to this questions. We have been researching this as well for a product.

I am surprised to see that so many people have issues with email delivery. Though email delivery can be delayed and in theory there are no guarantees.

Have you considered using SMS or a 2FA App like Duo? They should be near instantaneous.

The idea of sending this over telegram or signal is a good approach though the costs of Whatsapp messaging would be prohibitive. Even SMS will not work at scale. So really boils down to 2 things

(1) Speed - can you service live with delays or provide an alternate? (2) Cost - this cannot be tied to the per message cost like transactional or promotional email/SMS. A different pricing model help.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#97

Post by samb1729 »

Macha wrote: post #58
jiofih wrote: post #54

Earlier quoted context omitted.

Email has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.

I have both a personal G Suite domain (formerly "Google Apps For Your Domain") and my employer's G Suite account where in both cases I've experienced 5+ minute delays on a semi-frequent basis.

> (formerly "Google Apps For Your Domain")

And now formerly G Suite, as it's become Google Workspace. Gotta keep that "products rebranded per decade" quota up, it seems!

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#98

Post by petercooper »

albertgoeswoof wrote: post #20
starbugs wrote: post #18

Earlier quoted context omitted.

We ended up purchasing a dedicated IP from Mailgun. This solves the spam/latency problem mostly, but brings about new problems.

What other problems do you face with a dedicated IP?

Not MailGun, but we have 3 dedicated IPs with SendGrid and one problem is that there are spamlists and ISPs that block or mark down IP blocks owned by SendGrid so you get no real advantage from the dedicated IP. I wish you could "bring your own IP" to these services.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#99

Post by z77dj3kl »

We implemented a passwordless, OTP-to-email login system, and doing user research, people just complain it's too complicated. They don't like logging in to their Gmail and (as others have mentioned) waiting a few moments. It's especially bad on something like mobile. People like to use passwords, apparently.

I see passwords as reducing security (we have a low-security product so people can reset with an email, so security-wise, the upper bound is your email security), hence we used it. But people prefer the "remember the secret" shortcut!

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#100

Post by cesarb »

Nemo157 wrote: post #44
innocenat wrote: post #14

Earlier quoted context omitted.

I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.

A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.

That assumes the user can click the link on the phone. The reason a user might be "using a shared/public computer out of necessity" might be because the user does not at that moment have working Internet on the phone. For instance, the user might be outside the home area without a roaming agreement, or the user might be out of prepaid credits on the phone.
Post reply on HN