Scryfall.com (a Magic the Gathering search engine and deck building site) does this and the experience is very nice. I'd have to check, but the session Scryfall uses feels pretty long. I rarely, if ever have to authenticate again on the same browser/machine. This would likely be more annoying if I had to do it every day.
Ask HN: Why aren't one-time sign in links more popular for authentication?
141–150 of 198 posts
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#142I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.
It would be really, drastically lovely if that were to happen. For bonus points, encrypt the client certs with a master password and sync between a user's devices.
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#143I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.
Perhaps one the main reasons is that a large number of people use multiple devices or even multiple browsers on the same device. Not sure how SSL client certificate authentication accommodates that.
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#144We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…
4. Gmail (atleast on Android) will try to open the link in a sort of Webview, which is never ideal. All the browser options are gone, plus I don't need to trust Gmail with the ability to read screen contents.
This is exactly the reason why I hate sites that use one-time email sign-in links. The link opens in Webview, then you have to click a separate button to reopen the page in Safari, but by that time the token is marked as used, so you can't login except in this temporary window that is going to immediately disappear the second you perform any other action.
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#145Earlier quoted context omitted.
I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.
A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.
We did this for Mozilla Hubs (hubs.mozilla.com) specifically so people can easily sign in from within a VR headset which doesn't have a password manager and which is hard to type in.
However, the problem is that this goes so much against user expectations it just confuses people and they end up going through the grueling version of typing the long link in by hand in VR since they can't imagine it could be as easy as opening it on their phone. (We of course, call this out in the prompt, but nobody reads that.)
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#146We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…
I resonate deeply with this comment. As an extension to your second point, sometimes I want to login to a service on a shared/public computer out of necessity. I'd really not want to login into my email on said computer too.
I just assume my every keypress on a public/shared PC gets keylogged, so a password is not a great option either.
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#147I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.
Isn't the problem with this that it means your account is tied to your browser install? Eg, you'd need to copy the cert to another machine to sign in, would need to ensure it's backed up, etc.
Password management already is to basically that extent and the tools to copy that information around, backup, etc. also have come into existence to support usage beyond a single browser install.
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#148I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.
Because the UI for managing client certificates is terrible , with no real support for distributing a cert to multiple endpoints unless you're in an enterprise environment with device management, or issuing smart cards and readers. I do think there's legs in client certs for enterprise authentication, but for consumer products it's a non-starter.
I wonder if this is something that cloud password managers like 1Password could tackle.
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#149I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.
It's the way Spanish government webapps work with the citizens but it's a bit confusing to be honest. When it works it's perfect but the setup is complicated, so they're introducing an optional user/password login also.
Re: Ask HN: Why aren't one-time sign in links more popular for authentication?
#150Earlier quoted context omitted.
Password management is better, not worse, for security.
What is your argument for that? That people will choose better passwords (unique and long) since they don't need to remember them? The Achille's heel of password managers is if someone accesses your computer (physically or remotely) they can probably access all your accounts. <-- and I've seen this happen (not to me)
It's much more difficult to compromise someone's computer than it is to obtain/get one of their passwords thru phishing/guessing and then try the combination on a bunch of sites.
It's -vastly- better for casual users to have secure, single-use passwords instead of what most casual people do: have 1-2 insecure passwords with variations. Thus allowing any phisher to get access to everything anyways.
Just because something isn't perfect doesn't mean it is not an improvement.