Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#131

Post by CuriousCosmic »

gog wrote: post #118
CuriousCosmic wrote: post #64

Earlier quoted context omitted.

The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user. This usually happens because whatever service the site is using to handle sending out emails is under heavy load, having issues, or is rate limiting the site due to a s…

> The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user That is not completely true. I've been operating my own mail server for almost a decade, since I am the only person using it the volume of email I send out is almost n…

You'd have to look at your logs when it happens but google has a habit of tarpitting(i.e. repeatedly delaying email receipt) emails from servers they don't necessarily "trust". For large providers (i.e. those that would be used for handling one-time link emails), this normally isn't a problem however for small or self hosted email servers it can be from time to time.

I'm not sure what all goes into ~~the algorithm~~ that google uses to decide to tarpit emails from a server but I'd make sure that you have your SPF, DKIM, and DMARC all set up properly to give google as little of an excuse to dislike your server as possible.

It's not a great solution but I've long since given up on any attempt at self-hosting email and just use my own domain with protonmail at this point since the industry seems to be so hostile to self-hosting.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#132

Post by motohagiography »

shireboy wrote: post #84

I know a guy who as a matter of course sets his passwords to long random strings. When he wants to log into something, he then uses the sites’ “forgot password” as his “OTP” to assign a new one, log in with it. He does not store the random string, so his password is random, he doesn’t know it. Sounds like a lot of trouble, but my point is “forgot password” can kinda be otp for those paranoid enough.

Given a scheme is only ever as secure as its recovery process, he's not wrong.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#133

Post by newscracker »

shireboy wrote: post #84

I know a guy who as a matter of course sets his passwords to long random strings. When he wants to log into something, he then uses the sites’ “forgot password” as his “OTP” to assign a new one, log in with it. He does not store the random string, so his password is random, he doesn’t know it. Sounds like a lot of trouble, but my point is “forgot password” can kinda be otp for those paranoid enough.

This is fine until a platform or service decides to lock his account or permanently disable it because of frequent password reset attempts. If he’s lucky, he may be able to use a phone number connected to the account to get in. If not, then that’s the end of it. Seeing the kind of login patterns that many sites track for security reasons and how bad their judgments can be, I personally wouldn’t take such a risk.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#134

Post by justusthane »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

Yeah. In theory it’s a neat idea—in practice I hate it.

There’s one service that I literally can’t log in to because the link has always expired by the time I receive it.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#135

Post by CuriousCosmic »

conductr wrote: post #114
CuriousCosmic wrote: post #64

Earlier quoted context omitted.

The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user. This usually happens because whatever service the site is using to handle sending out emails is under heavy load, having issues, or is rate limiting the site due to a s…

> The issue isn't with the user's email As an email layman, I don’t fully buy this, can you explain? I’ve sent emails with multiple CC’s and most get it quick while one or two people have to wait for it to hit their inbox for multiple minutes. I assume they all leave my service at same time and the delay is caused by the receiving mail server.

So I'll preface that I'm by no means an expert.

The issue can occasionally be the user's email provider but for the most part issues with implementing one-time links will be the site's responsibility/a problem on their end.

As for email occasionally being super slow, Google and Microsoft (to a lesser extent) will tarpit(repeatedly delay the acceptance of emails from a specific address or entire domain) emails arbitrarily. This normally isn't anything meaningfully repeatable and is essentially ~~the algorithm~~ arbitrarily deciding it dislikes some certain email, email address, or server. Those emails will eventually get to their recipient but effectively get frozen in time for a bit before getting delivered.

For normal person to person emails, this boils down to bad luck and occasional inconvenience however for any heavily templated email (like say an email containing one-time links), this means something on the site's side is causing the emails to appear as spam or spam-like to the recipient server. So technically it is the user's email server causing the delay but it's usually due to something in particular on the site's side be it a domain or server configuration or something about the email contents.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#136

Post by elwell »

_carl_jung wrote: post #29
asutekku wrote: post #7

It's inconvenient. That's the primary reason why it won't gain mass adoption since any obstacle to your service will lower the registration / engagement metrics. With password managers built into all modern browsers, casual users (which, lets be honest here, are by far the most of the web users) do not have to worry about typing passwords. Security be damned. If it is not invisible to the user, they will reject it.

Password management is better, not worse, for security.

What is your argument for that? That people will choose better passwords (unique and long) since they don't need to remember them?

The Achille's heel of password managers is if someone accesses your computer (physically or remotely) they can probably access all your accounts. <-- and I've seen this happen (not to me)

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#137

Post by Willamin »

I wonder why SSL Client Certificate Authentication hasn't become popularized for the web.

1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#139

Post by jon-wood »

Willamin wrote: post #137

I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.

Because the UI for managing client certificates is terrible, with no real support for distributing a cert to multiple endpoints unless you're in an enterprise environment with device management, or issuing smart cards and readers. I do think there's legs in client certs for enterprise authentication, but for consumer products it's a non-starter.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#140

Post by gfodor »

Willamin wrote: post #137

I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.

Isn't the problem with this that it means your account is tied to your browser install? Eg, you'd need to copy the cert to another machine to sign in, would need to ensure it's backed up, etc.
Post reply on HN