Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

191–198 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#191

Post by jethro_tell »

ytch wrote: post #178
jethro_tell wrote: post #117

Earlier quoted context omitted.

How would that work? Send an email to every customer (domain, so pick a single customer at every domain) and send them an email with a fake login, or a note that says please disregard? Aside from that being spam, it's also likely to get legit emails stuck in spam filters as people start marking them as spam. Secondly, I think most of the largest providers don't really grey list any longer. They seem to have moved to…

> Send an email to every customer (domain, so pick a single customer at every domain) Greylist is allow/block based on sender IP, not receiving metadata, so I guess pre-send mail from the IP might help, but yes, other rules might slow down.

It's not just connect based, you have to connect and send an email. Which would be spam. Most systems I've worked on score based on how much your server looks like it's doing its job and moving on.

Long connection with inactivity get tagged, scored and disconnected.

Connecting without sending an email leaves you in the grey list queue.

There is to my knowledge not a great way to pre-warm for grey-listing

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#192

Post by elwell »

UncleMeat wrote: post #188
elwell wrote: post #136

Earlier quoted context omitted.

What is your argument for that? That people will choose better passwords (unique and long) since they don't need to remember them? The Achille's heel of password managers is if someone accesses your computer (physically or remotely) they can probably access all your accounts. <-- and I've seen this happen (not to me)

Yes. The huge huge huge majority of credential attacks are stuffing and phishing. Unique passwords prevent stuffing. We observe that everybody reuses passwords unless they use a password manager. Password managers with auto fill can also provide some defense against phishing since they won’t auto fill. The Achilles heel you mention matters very little since it is a very rare threat model and it would be unreliable to…

> it is a very rare threat model

I agree, but perhaps password managers aren't a one-size-fits-all solution. People in high risk situations (e.g., admin @ crypto companies) that are likely to be specifically targeted, might be better served without a password manager. But yes, if RDP, e.g., is left on and open then a keylogger could be installed anyways...

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#193

Post by bvcvbuiy »

slovette wrote: post #190

I personally think nearly everyone here is wrong. Working in IT with a direct day-to-day relationship with end users, passwords are the bane of all existence. You say email delivery or sms is slow, but how often is it slow for users? Data on this? I personally have never seen a significant delay for an OTP code to either my inbox or my email (Google & Verizon). I have seen users that have an old email configured that…

> It can’t be more inconvenient than having to go through a password reset process once a week (which believe it or not, a TON of end users do).

That is what I do with many services I use. I ask a reset password link every time I use them. I then just copy paste a random passphrase as new password and forget about it.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#194

Post by bvcvbuiy »

shireboy wrote: post #84

I know a guy who as a matter of course sets his passwords to long random strings. When he wants to log into something, he then uses the sites’ “forgot password” as his “OTP” to assign a new one, log in with it. He does not store the random string, so his password is random, he doesn’t know it. Sounds like a lot of trouble, but my point is “forgot password” can kinda be otp for those paranoid enough.

I do that for some services I rarely use. That works actually fairly well.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#195

Post by UncleMeat »

elwell wrote: post #192
UncleMeat wrote: post #188

Earlier quoted context omitted.

Yes. The huge huge huge majority of credential attacks are stuffing and phishing. Unique passwords prevent stuffing. We observe that everybody reuses passwords unless they use a password manager. Password managers with auto fill can also provide some defense against phishing since they won’t auto fill. The Achilles heel you mention matters very little since it is a very rare threat model and it would be unreliable to…

> it is a very rare threat model I agree, but perhaps password managers aren't a one-size-fits-all solution. People in high risk situations (e.g., admin @ crypto companies) that are likely to be specifically targeted, might be better served without a password manager. But yes, if RDP, e.g., is left on and open then a keylogger could be installed anyways...

Admins at crypto companies should be getting security advice from their security gurus rather than from the web. It is reasonable to suggest that most people use a password manager. For the few people where this isn't good enough, they likely know who they are.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#196

Post by tatersolid »

mjl- wrote: post #37

i'm using this approach for a project (for a customer) where they don't want their users sharing their login details (username/password) with others. so it's a way to keep some control over who is accessing the system. the assumption is that people won't share credentials for their mailbox with others. email is still mostly sent as plain text over the internet, that's certainly a downside. email delays haven't been a…

> email is still mostly sent as plain text over the internet, that's certainly a downside.

Opportunistic TLS for SMTP seems to have been dominant on the US portion of the internet for nearly a decade. Especially as email is concentrated in a few huge providers who have been using STARTTLS for many years.

I say this based on the systems and logs I have monitored in that same timeframe. In fact, many email systems (mostly corporate MS Exchange) appear to be configured to reject or spam-bucket email connections that don’t support STARTTLS with a public CA certificate. (This observation may be biased by covering the financial services industry more than others.)

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#197

Post by derangedHorse »

Context switching really is a huge hassle which is why I absolutely abhor email logins. We as user have become privileged with high speed interactions on the web and any hit to it will definitely have an effect on user retention. Also keep in mind that most internet services are bottlenecked by network latency. When asking a user to login with email it adds in the time the user takes to physically navigate through the pages of the email client and the 'n' network requests needed to open an email and follow a link.

See https://www2.deloitte.com/content/dam/Deloitte/ie/Documents/... for more information on how cutting hairs on latency can dramatically affect an application's adoption rate

Post reply on HN