Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

21–30 of 230 posts

Re: Are Magic Links Outdated?

#21

Post by mffap »

kevincox wrote: post #12
jarsbe wrote: post #7

It depends. I used magic links for a system where the user would log in every 6-12 months. It didn't make sense to force them to make a password.

Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Register: 1. I click the password field. 2. I click "use autogenerated password" 3. Sign up. For login: 1. Click "login". The magic link experience is comparatively awful: 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site…

If you'd take a passwordless login with FIDO2 (now promoted "Passkeys" by Apple and Google) it would mainly require to use FaceID / Windows Hello / Fingerprint / PIN ... or whatever your devices deem necessary. Could be used on any and cross-device.

Re: Are Magic Links Outdated?

#22

Post by vgel »

TekMol wrote: post #17

I wish there was a way to read all cookies of the current site and create a bookmarklet that sets them again. So I could log into GitHub and save the cookies in a bookmarklet. Then every time I want to use GitHub, I click the bookmarklet and it sets the cookies, so I am logged in. I dabbled with the idea a bit, but it seems not straight forward. Maybe due to some metadata that cookies carry. They are not just key:val…

You might be running into issues with session cookies and HttpOnly cookies: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#re...

Re: Are Magic Links Outdated?

#23

Post by MrDunham »

> Email Security: ...Should someone gain access to another user's inbox, they simultaneously receive the keys to logging into profiles that run on magic links. Therefore, a single cyber-attack on your email could lead to unwanted activity on many of your utilized virtual services

This statement only partially covers the problem.

I once had a cofounder leave my company on bad terms. He had access to the bank accounts, I had email admin.

It took me 5 seconds to get full bank account access and lock him out with access to his email ("forgot password").

It's astounding how much of a skeleton key our inbox has become. This community doesn't need reminding, but our families do.

Re: Are Magic Links Outdated?

#24

Post by mffap »

capableweb wrote: post #5

Article fails to mention that "Magic Links" are not only possible via email, but any out-of-band method, so you could use Whatsapp, Telegram or IRC even. Obviously, the user is assumed to have a secure setup regarding whatever method you send the link via. Which the "Email Security" section kind of hints to as well, that it's important users have a secure email setup. What they fail to mention, is that this is import…

How should an honest look at the topic include for your, that's lacking in the article? You mentioned the focus on email instead of other channels. Anything else? Thanks for the feedback.

Re: Are Magic Links Outdated?

#25

Post by kevincox »

mffap wrote: post #21
kevincox wrote: post #12

Earlier quoted context omitted.

Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Register: 1. I click the password field. 2. I click "use autogenerated password" 3. Sign up. For login: 1. Click "login". The magic link experience is comparatively awful: 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site…

If you'd take a passwordless login with FIDO2 (now promoted "Passkeys" by Apple and Google) it would mainly require to use FaceID / Windows Hello / Fingerprint / PIN ... or whatever your devices deem necessary. Could be used on any and cross-device.

This may be a good future. But it seems like this isn't available to most people on most browsers yes. Especially if you want to sync across ecosystems.

I like how tangible passwords are. Even with a password manager I can write them on a piece of paper, store then in a vault and enter them into a new computer. My grandmother understands this process.

The key-based systems are basically magic. Magic that works great as long as you are inside the defined parameters on supported devices. I think it will be years after the "first baked release" before we see relatively user friendly manual backup and restore. Something this is second nature in most password managers.

Re: Are Magic Links Outdated?

#26

Post by spicyjpeg »

TekMol wrote: post #17

I wish there was a way to read all cookies of the current site and create a bookmarklet that sets them again. So I could log into GitHub and save the cookies in a bookmarklet. Then every time I want to use GitHub, I click the bookmarklet and it sets the cookies, so I am logged in. I dabbled with the idea a bit, but it seems not straight forward. Maybe due to some metadata that cookies carry. They are not just key:val…

That would not work for a number of reasons, the first one being the fact that virtually every service now uses HttpOnly cookies for session management (to make it harder for e.g. XSS injected code to steal sessions). In addition to that session cookies are usually rotated very frequently, with servers occasionally updating them even if you stay logged in; it goes without saying that if you log out and back in you will almost surely get a different session token each time.

Re: Are Magic Links Outdated?

#27

Post by mmikeff »

clement_b wrote: post #6

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

I also hate them, my email is slow and mobile internet is almost non-existent at my house, so now I am waiting for an email to arrive in my inbox before I can login, or I am waving my phone around trying to get reception to receive a code.

I'm sure I am not the only one with those issues. As said above, this would all be fine if Magic Link was an option rather than the only way to sign in.

Re: Are Magic Links Outdated?

#28

Post by mffap »

mojuba wrote: post #19

Another relatively new problem with magic links specifically on mobile is that your email client will likely open the link in an embedded browser which is typically isolated from the main browser app and doesn't share the cookies with it. There are some workarounds for this but they don't seem very secure, plus they add some complexity. E.g. once the backend validates the magic link click, it logs the user in also in…

> Also the page that initiated it should periodically refresh itself to see if the session was validated somewhere else.

I guess the link must be disabled / invalidated after first use and your auth server and client obviously must verify if a given link is still valid.

Re: Are Magic Links Outdated?

#29

Post by ricardo81 »

The article doesn't seem to cover a potential issue- updating an email address associated with an account (2FA aside).

If you've somehow lost access to email, a typical pattern is that you can login to your account, update the username and receive a validation email at the new address to confirm its validity.

Re: Are Magic Links Outdated?

#30

Post by bradgessler »

I wrote a Rails plugin for magic links at https://github.com/rocketshipio/nopassword that doesn’t suffer from many of the problems I’m seeing in the comments.

The big thing is I only use a 6 digit numerical code that people have to copy and paste or type into the browser which they’re authenticating. I looked at stuffing a token into a URL, but it’s not a good idea because the email client may try opening the link to preview it or it may try opening the link in the wrong app/browser, such as an in-app browser.

That may sound super insecure, but the 6 digit code is half the secret that’s needed to authenticate. The browser that the person is using to login has a much longer complex secret that must be included with the code. Additionally, this combination must be authenticated within a set number of attempts, 3 by default, within a certain timeframe, 5 minutes by default.

My motivations for creating this, instead of using something like devise with passwords, is because I have seen soooooo many non-technical people get tripped up by passwords. I know there’s sign-in with Google, MS, etc. via OAuth, but I wanted to give people a way to login to web applications without being under the watchful eye of big tech.

I’m currently using it in production for all of my Rails apps, like https://legiblenews.com/email_authentication/new

A better description of why and how it works at https://github.com/rocketshipio/nopassword

Post reply on HN