Are Magic Links Outdated?

#1

Post by mffap » Wed, Jul 13, 2022, 9:33 AM UTC

Re: Are Magic Links Outdated?

#2

Post by yababa_y » Wed, Jul 13, 2022, 9:51 AM UTC

They don’t seem that outdated to me, given the evidence presented. email provider security is a real problem but is usually considered the root of trust for persons…

Re: Are Magic Links Outdated?

#3

Post by amadeuspagel » Wed, Jul 13, 2022, 10:24 AM UTC

I've been thinking about magic links using QR codes rather then email.

EDIT: The idea here is that on a device where you're already logged in you generate a QR code, you photograph that code on another device, and then you confirm on the first device that it's really you who photographed the code on the other device.

Re: Are Magic Links Outdated?

#4

Post by nnx » Wed, Jul 13, 2022, 10:29 AM UTC

yababa_y wrote: post #2

They don’t seem that outdated to me, given the evidence presented. email provider security is a real problem but is usually considered the root of trust for persons…

Also a possible way for magic links to be secure even if email is compromised is for the requesting browser to create a secret client side so that only that browser can actually proceed with the magic link.

Re: Are Magic Links Outdated?

#5

Post by capableweb » Wed, Jul 13, 2022, 10:31 AM UTC

Article fails to mention that "Magic Links" are not only possible via email, but any out-of-band method, so you could use Whatsapp, Telegram or IRC even. Obviously, the user is assumed to have a secure setup regarding whatever method you send the link via.

Which the "Email Security" section kind of hints to as well, that it's important users have a secure email setup. What they fail to mention, is that this is important not only if you use "Magic Links" but also if you have username+password login with "Reset my password" functionality, as otherwise intruders will be able to change your password anyways.

In conclusion, the article seems to have been written with the goal of saying "Everyone is using Magic Links, how can we get them to use Zitadel (their product) instead?", rather than an honest look on how "Magic Links" can be made more secure.

Re: Are Magic Links Outdated?

#6

Post by clement_b » Wed, Jul 13, 2022, 10:38 AM UTC

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

Re: Are Magic Links Outdated?

#7

Post by jarsbe » Wed, Jul 13, 2022, 10:44 AM UTC

It depends. I used magic links for a system where the user would log in every 6-12 months. It didn't make sense to force them to make a password.

Re: Are Magic Links Outdated?

#8

Post by Mordisquitos » Wed, Jul 13, 2022, 10:44 AM UTC

amadeuspagel wrote: post #3

I've been thinking about magic links using QR codes rather then email. EDIT: The idea here is that on a device where you're already logged in you generate a QR code, you photograph that code on another device, and then you confirm on the first device that it's really you who photographed the code on the other device.

I don't understand. What would the QR encode? Surely not the magic link itself, as that would defeat the purpose.

Re: Are Magic Links Outdated?

#9

Post by joosters » Wed, Jul 13, 2022, 10:45 AM UTC

nnx wrote: post #4

yababa_y wrote: post #2

They don’t seem that outdated to me, given the evidence presented. email provider security is a real problem but is usually considered the root of trust for persons…

Also a possible way for magic links to be secure even if email is compromised is for the requesting browser to create a secret client side so that only that browser can actually proceed with the magic link.

If the email is compromised, the hacker can just go to the front page in their own browser and generate a fresh login email, so there's no extra protection in client-side browser secrets.

Re: Are Magic Links Outdated?

#10

Post by joe_fishfish » Wed, Jul 13, 2022, 10:47 AM UTC

clement_b wrote: post #6

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

If it's magic link or multi-factor authentication, I know which one I prefer. Try explaining to an MFA-loving service that your phone is out of action while it's being repaired.