Ask HN: Why aren't one-time sign in links more popular for authentication?

Post by sethammons » Mon, Jan 04, 2021, 2:05 PM UTC

albertgoeswoof wrote: post #21

camhart wrote: post #16

Earlier quoted context omitted.

4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.* * Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.

Dedicated IPs aren’t great because they’re completely untrusted. Better to sign up with a smaller email provider than mailgun/ses

Post by squiggleblaz » Mon, Jan 04, 2021, 2:09 PM UTC

hnlmorg wrote: post #92

squiggleblaz wrote: post #79

Earlier quoted context omitted.

I meant my first comment in jest. I will consider your advice, but I imagine switching from one password manager to another will only certify me as a genuine and eternal password hater. (Also, a password stored in a password manager is something you have, not something you know, so it's completely inconsistent with the principle of MFA. I mean, the reasons to hate passwords just increase as long as I think about it.…

There is another option if you wish to adhere to the principle of "something I know" and that's to generate a base64 key. eg SITE="www.example.com" SALT="passphrase" printf "${SALT}${SITE}" | shasum -a 512 | base64 | cut -c -25 (Though you're better off using some online tool that converts SHA 512 to base64 directly since the example above converts the ASCII string of a hex representation of the SHA 512 hash into bas…

Post by AlchemistCamp » Mon, Jan 04, 2021, 2:12 PM UTC

krageon wrote: post #59

ketamine__ wrote: post #51

Earlier quoted context omitted.

I've experienced that too.

Then you haven't used it for very long. Besides that, more exists than some tech giant's gambit to gather and exploit as much user information as they can. Nobody should use gmail, unless they are forced to by their job (in which case they should try to change it if they are in a position to).

Post by jwr » Mon, Jan 04, 2021, 2:15 PM UTC

jiofih wrote: post #54

jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

Email has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.

Post by jwr » Mon, Jan 04, 2021, 2:17 PM UTC

Someone wrote: post #46

wruza wrote: post #45

Earlier quoted context omitted.

Why can all instant messengers do this “instant” part and email cannot? I’m aware of mta chains, decentralization, etc, but heck.

Because, as jwr says, it was never meant to be. The mental model is that of regular mail that gets collected at post offices, then split by major destination, sent on, and finally ends up in a mailbox. Mail servers do not even have to be on the internet ( https://en.wikipedia.org/wiki/Non-Internet_email_address ), or on a network at all. It was fairly normal to have a time sharing system dial in to a mail server ever…