Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#121

Post by albertgoeswoof »

sethammons wrote: post #101
albertgoeswoof wrote: post #21

Earlier quoted context omitted.

Dedicated IPs aren’t great because they’re completely untrusted. Better to sign up with a smaller email provider than mailgun/ses

I work with Twilio SendGrid. What do you mean? IPs are the de facto way that reputation is tracked and a dedicated IP’s trust is based on your sending habits. How would a smaller provider be better? The only thing that I can think is similar IP ranges can also influence delivery, so you may want a dedicated range for transactional email. I don’t see smaller providers as able to do that.

A new dedicated IP is unknown and some providers will automatically treat it as untrusted and give it a lower score.

A smaller email provider can give you a shared IP that has other users and is therefore already whitelisted. Provided the email provider has good anti-spam approaches (e.g. enforced DKIM verification), you should have better luck with that shared IP over a dedicated one if you only send a few thousand emails a month.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#122

Post by beh9540 »

We tried this on a b2b SaaS product I worked on where we had a lot of "third party" users (volunteers for a customer) who were only going to use the application once a year at most. One of the biggest hurdles we had was explaining it to enterprise customers - when they were doing their due diligence, it didn't "check the box" and we had to change it pretty early on in order to accommodate this.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#123

Post by jjoonathan »

wruza wrote: post #42
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

>sign up/sign in Why were clear terms like login/register/logout replaced with a “sign ...”? I get confused twice a week by these, especially because the difference between “in” and “up” is so subtle (and overloaded, like “sign up for a meeting at friday”, unrelated to registration routine). Sorry for offtopic, but it is really annoying. Is it more linguistically correct or just a hipster thing?

> "sign ..."

Sometimes literally that, with an ellipsis hiding the part that would otherwise distinguish between alternatives, so you just have to click and guess.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#124

Post by runako »

sethammons wrote: post #108

Why not use some federated log in like Okta? Not as many issues as email on the delivery side.

Passwords are free, Okta is not. Also creates a ton of friction for users, most of whom will not have any federated login installed.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#125

Post by da_big_ghey »

jiofih wrote: post #54
jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

Email has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.

Thirty seconds is not instantaneous and is much slower than typing a password. The only server that shows mail the instant it's sent is the one I run for my personal use, which is a bad solution for most.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#126

Post by combatentropy »

wruza wrote: post #42
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

>sign up/sign in Why were clear terms like login/register/logout replaced with a “sign ...”? I get confused twice a week by these, especially because the difference between “in” and “up” is so subtle (and overloaded, like “sign up for a meeting at friday”, unrelated to registration routine). Sorry for offtopic, but it is really annoying. Is it more linguistically correct or just a hipster thing?

Interesting. I've always liked "sign up", "sign in", and "sign out", because they were older and more widely used before computing. "Sign up" was used to refer to subscribing, for example, to a magazine. "Sign in" and "sign out" were what they said for the guestbook at a hotel.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#127

Post by weeboid »

runako wrote: post #120

Because it's awful. A normal flow for me is credentials stored in browser/password manager. Login is more or less seamless, and typically takes under a second. OTP login is multiple steps, involves me doing a copy/paste (or remembering the code), and requires a mandatory delay while I wait on the email. If I wanted to login incognito, or in a different browser, I may have to copy/paste the URL etc. A better question…

To truly advocate a position here, first the LCD must be reasoned for, which is, "my grandmother", or "cool and always drunk uncle", or "xyz frat bro/sorority sis"

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#128

Post by weeboid »

shireboy wrote: post #84

I know a guy who as a matter of course sets his passwords to long random strings. When he wants to log into something, he then uses the sites’ “forgot password” as his “OTP” to assign a new one, log in with it. He does not store the random string, so his password is random, he doesn’t know it. Sounds like a lot of trouble, but my point is “forgot password” can kinda be otp for those paranoid enough.

OTP, with extra steps :D

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#129

Post by riedel »

jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

Funny that SMS second factor auth took off. I remember that the sometimes hour long delays in SMS .

I actual was astonished by the simplicity of sign in links when for the first time using gather.town . I have seen then also in banking (revolute) with IP address pinning which proved to be annoying because this randomly switched depending on network availability.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#130

Post by arminiusreturns »

Nemo157 wrote: post #44
innocenat wrote: post #14

Earlier quoted context omitted.

I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.

A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.

As a counterpoint to this, I quite dislike this approach, especially when the auth is a link instead of a OT2P, because now whatever I am accessing has metadata and can cross-correlate data from other providers about my phone. Amazon is one in particular that I experience, and I never click the link, and rather just type it out by hand on the system I am already trying to log in via.
Post reply on HN