Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#151

Post by hrktb »

jiofih wrote: post #54
jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

Email has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.

"never" doesn't feel instantaneous though.

Joking aside, email never coming is a pretty common occurence for me on new services, especially small orgs (local clubs, small merchants)

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#152

Post by theandrewbailey »

Willamin wrote: post #137

I wonder why SSL Client Certificate Authentication hasn't become popularized for the web. 1. Browser visits a site that needs authentication. 2. Browser checks if there's already an existing client cert. 3. If not, browser generates one. 4. Browser uses it in the SSL handshake, resulting in the user being signed in without passwords, cookies, email links, etc.

UIs to use client certificates are terrible, and key and certificate storage almost always involves a password anyway.

My day job occasionally involves a WebDAV server protected with a normal login plus a client certificate. Sometimes I need to explain the process to less technically literate people who use different client software than I do, and the certificate part is a total pain.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#153

Post by iggldiggl »

codethief wrote: post #83
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

> 1. Email delivery latency This is particularly true when the recipient has enabled Greylisting[0] and delivery has to be attempted multiple times (which is perfectly fine from the point of view of the RFC standards). In view of this, email delivery rather resembles real-world postal package delivery (and not so much the instantaneous delivery of, say, phone calls). [0] https://en.wikipedia.org/wiki/Greylisting_(ema…

This can be particularly fun if the sender uses Amazon SES for example, because Amazon randomly rotates through its mail servers on each retry attempt, so a simple greylisting implementation (based on exactly matching the full IP) delays the mail by not just one, but possibly multiple retry intervals until by chance Amazon happens to use to original server again.

So you either need to whitelist Amazon SES (and possibly a few other providers behaving similarly), or use a greylisting implementation which doesn't match the full IP (I think Mailcow by default e.g. uses /19 for matching IPv4 addresses).

A previous mail hoster of mine did the former, i.e. Greylisting based on the full IP, and what was even worse, their support staff totally denied any knowledge of it and tried to claim it wasn't their fault that any e-mails from Amazon (Amazon itself and anything using SES) would arrive with random amounts of large delay.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#155

Post by iggldiggl »

camhart wrote: post #16
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts. At times those accounts can get the IP address added to spam lists. All the sudden your emails stop getting received on some clients.* * Solution to this is to pay $$ / month to get a dedicated IP address, then never let it get added to a spam list.

> 4. Email delivery period. Using AWS Simple Email Service, you're actually sharing an email server IP address with other accounts.

They also randomly rotate through their mail servers on each retry attempt, so a simple Greylisting implementation based on matching the full IP address can delay your emails for not just one retry interval, but several (until by chance Amazon happens to reuse the IP of the original delivery attempt).

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#156

Post by roseway4 »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

(1) is tractable. A number of email sending providers offer SLAs around delivery latency. Some also provide significant deliverability resources to help senders mitigate the risk of spam foldering.

Source: I work for SparkPost and we do all of the above.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#157

Post by sethammons »

albertgoeswoof wrote: post #121
sethammons wrote: post #101

Earlier quoted context omitted.

I work with Twilio SendGrid. What do you mean? IPs are the de facto way that reputation is tracked and a dedicated IP’s trust is based on your sending habits. How would a smaller provider be better? The only thing that I can think is similar IP ranges can also influence delivery, so you may want a dedicated range for transactional email. I don’t see smaller providers as able to do that.

A new dedicated IP is unknown and some providers will automatically treat it as untrusted and give it a lower score. A smaller email provider can give you a shared IP that has other users and is therefore already whitelisted. Provided the email provider has good anti-spam approaches (e.g. enforced DKIM verification), you should have better luck with that shared IP over a dedicated one if you only send a few thousand…

ah, I see what you are saying. Better shared pool management by the larger senders would help, but a smaller sender should be able to more aggressively protect their shared IPs; I agree in principle. This is extra important for infrequent sending.

I still contend that a dedicated IP is superior for deliverability reputation as long as you are sending enough email. For a brand new (to you) dedicated IP, it will need to be warmed up (gradually increase the amount of traffic it sends). There are automated and manual processes to accomplish that, including "pre-warmed" dedicated IPs that were previously in a "good enough" shared pool.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#159

Post by gog »

CuriousCosmic wrote: post #131
gog wrote: post #118

Earlier quoted context omitted.

> The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user That is not completely true. I've been operating my own mail server for almost a decade, since I am the only person using it the volume of email I send out is almost n…

You'd have to look at your logs when it happens but google has a habit of tarpitting(i.e. repeatedly delaying email receipt) emails from servers they don't necessarily "trust". For large providers (i.e. those that would be used for handling one-time link emails), this normally isn't a problem however for small or self hosted email servers it can be from time to time. I'm not sure what all goes into ~~the algorithm~~…

Thank you. I've checked my logs and everything looks normal on my end and I do suppose it is some kind of tarpitting, but it doesn't show in the logs.

I do have DKIM, strict SPF and DMARC policies, MTA-STS, SMTP TLS Reporting, latest TLS support and valid certificates, there is nothing else I can do on my end.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#160

Post by medmunds »

CuriousCosmic wrote: post #64
ketamine__ wrote: post #51

Earlier quoted context omitted.

I've experienced that too.

The issue isn't with the user's email. The issue is with the site's email provider. If the email server sending out the one time links is under heavy load or for some reason has a backlog, it may take a while for the links to actually get to the user. This usually happens because whatever service the site is using to handle sending out emails is under heavy load, having issues, or is rate limiting the site due to a s…

> The issue isn't with the user's email. The issue is with the site's email provider.

Actually, it could be either. Postmark (the email provider for a bunch of sites) monitors "time to inbox" for several user email services: https://status.postmarkapp.com/. Apple, in particular, seems to frequently add 2+ minute delays on the receiving end. (The "source" link above the charts describes how Postmark collects the data.)

Post reply on HN