Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

31–40 of 230 posts

Re: Are Magic Links Outdated?

#31

Post by mojuba »

mffap wrote: post #28
mojuba wrote: post #19

Another relatively new problem with magic links specifically on mobile is that your email client will likely open the link in an embedded browser which is typically isolated from the main browser app and doesn't share the cookies with it. There are some workarounds for this but they don't seem very secure, plus they add some complexity. E.g. once the backend validates the magic link click, it logs the user in also in…

> Also the page that initiated it should periodically refresh itself to see if the session was validated somewhere else. I guess the link must be disabled / invalidated after first use and your auth server and client obviously must verify if a given link is still valid.

Of course the link should be invalidated, but that doesn't protect from a situation where an attacker initiates a login, then the user receives an email and clicks. The chances are slim but some people might get confused and click without much thinking - and voila, the attacker has a valid session.

Re: Are Magic Links Outdated?

#32

Post by astura »

>Though no official record of the first use of this method seems to exist, research suggests that their concept dates to the early 2010s.

Early 2010s? Craigslist has been doing this since the 90s.

Re: Are Magic Links Outdated?

#33

Post by sborsje »

There's a near-infinite amount of not-so-small gotchas when implementing magic links:

- If magic links are the only way to sign in, authentication success rate is now directly tied to your email deliverability rate.

- Single-use tokens (immediately expiring after clicking) can be followed by spam filters, and thus immediately become invalid for the actual user trying to sign in.

- MTAs using greylisting can cause unexpected delays in email delivery.

- If a session audit trail is implemented, malware scanners following links might cause sessions from unexpected locations showing up.

etc.

Re: Are Magic Links Outdated?

#34

Post by [deleted] »

bradgessler wrote: post #30

I wrote a Rails plugin for magic links at https://github.com/rocketshipio/nopassword that doesn’t suffer from many of the problems I’m seeing in the comments. The big thing is I only use a 6 digit numerical code that people have to copy and paste or type into the browser which they’re authenticating. I looked at stuffing a token into a URL, but it’s not a good idea because the email client may try opening the link to…

[deleted]

Re: Are Magic Links Outdated?

#35

Post by kaichanvong »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

yeah on Discord this is almost magic.

Re: Are Magic Links Outdated?

#36

Post by aaaaaaaaaaab »

bradgessler wrote: post #30

I wrote a Rails plugin for magic links at https://github.com/rocketshipio/nopassword that doesn’t suffer from many of the problems I’m seeing in the comments. The big thing is I only use a 6 digit numerical code that people have to copy and paste or type into the browser which they’re authenticating. I looked at stuffing a token into a URL, but it’s not a good idea because the email client may try opening the link to…

So if I have 700k usernames I can pwn one of them with 50% probability. Cool!

With 3 attempts allowed I only need 230k usernames, even better!

The "secret" stored in the browser doesn't protect you from this, since I'm not stealing someone's code; I'm logging in from my own browser. (Of course I'm doing this via a botnet, so you won't notice it by IP address)

Re: Are Magic Links Outdated?

#37

Post by mooreds »

Another issue that I don't see covered here is that some email clients (looking at you, Outlook) pre-fetch links to see if they are security risks. If you build a magic link system which handles plain old GETs, the one time code gets used up before the user can actually log in.

We ran into this at FusionAuth and had to do implement some workarounds, documented here: https://github.com/FusionAuth/fusionauth-issues/issues/629#i...

Edit: https://news.ycombinator.com/item?id=32081192 mentions this and some other issues.

Re: Are Magic Links Outdated?

#39

Post by pjc50 »

"Opening an email and clicking on a link" is one of the most risky things you can do with your computer; it's a critical stage in many successful security breaches. Why would you train people to do it?

Re: Are Magic Links Outdated?

#40

Post by mffap »

kevincox wrote: post #25
mffap wrote: post #21

Earlier quoted context omitted.

If you'd take a passwordless login with FIDO2 (now promoted "Passkeys" by Apple and Google) it would mainly require to use FaceID / Windows Hello / Fingerprint / PIN ... or whatever your devices deem necessary. Could be used on any and cross-device.

This may be a good future. But it seems like this isn't available to most people on most browsers yes. Especially if you want to sync across ecosystems. I like how tangible passwords are. Even with a password manager I can write them on a piece of paper, store then in a vault and enter them into a new computer. My grandmother understands this process. The key-based systems are basically magic. Magic that works great…

I'm glad that your grandmother uses a password manager. We actually had a lot of feedback from teens and children and the concept of MFA/2FA seems to be hard to understand for less technical people. We were surprised by the actual understanding after some user research.

Yes, availability on all browsers and devices is not yet up to 100%. I hope to see a fast adoption, but agree that it could actually take some time. I use Passkeys on a daily basis for the last ~1.5 years wherever possible and won't go back anytime soon :)

Post reply on HN