Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

41–50 of 230 posts

Re: Are Magic Links Outdated?

#41

Post by mooreds »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

Lots of issues with magic links. And yet, and yet. For a certain class of accounts, I'm okay deferring to my email inbox.

From a security perspective as a user, it's no different than deferring to a social provider like Google, but has the benefit in that it gives a user more control over the third party they choose to delegate control to.

You allow username/password access and that's great too. I'm a fan of giving users options, but I don't know if anyone has done studies and found that a single login option actually is better for conversion. I'd be interested in seeing some numbers around that.

I wouldn't recommend a magic link for high value accounts, but I have pretty easy access to my mailbox, from everywhere (in contrast to my password manager, which is cumbersome to use from different accounts). I can also forward the email with the link to any device where I have email.

If it is a low-value account that I use infrequently, I'm a fan. The alternative is to just use 'forgot password' to get a link that resets my password. That is pretty much the same functionality.

I guess the hard part there is that no one building software thinks their app is 'low-value'. :)

Re: Are Magic Links Outdated?

#42

Post by withinboredom »

kevincox wrote: post #25
mffap wrote: post #21

Earlier quoted context omitted.

If you'd take a passwordless login with FIDO2 (now promoted "Passkeys" by Apple and Google) it would mainly require to use FaceID / Windows Hello / Fingerprint / PIN ... or whatever your devices deem necessary. Could be used on any and cross-device.

This may be a good future. But it seems like this isn't available to most people on most browsers yes. Especially if you want to sync across ecosystems. I like how tangible passwords are. Even with a password manager I can write them on a piece of paper, store then in a vault and enter them into a new computer. My grandmother understands this process. The key-based systems are basically magic. Magic that works great…

Chrome supports a webauthn solution built-in if you don't have windows/platform authentication support. I think Firefox does too, and probably even Safari on really old machines. If you are targeting semi-modern browsers and devices made in the last 5-10 years, you should be fine.

Re: Are Magic Links Outdated?

#43

Post by withinboredom »

theginger wrote: post #18
Mordisquitos wrote: post #8

Earlier quoted context omitted.

I don't understand. What would the QR encode? Surely not the magic link itself, as that would defeat the purpose.

I think the idea is to stop mail providers automatically scannings the link, which would work until they start scanning the images for QR codes and scanning the links.

I don't understand how this would work if you are getting emails on the device you are trying to sign in with. Most devices (other than Android?) don't let you scan a code from a photo.

Re: Are Magic Links Outdated?

#44

Post by matsemann »

sborsje wrote: post #33

There's a near-infinite amount of not-so-small gotchas when implementing magic links: - If magic links are the only way to sign in, authentication success rate is now directly tied to your email deliverability rate. - Single-use tokens (immediately expiring after clicking) can be followed by spam filters, and thus immediately become invalid for the actual user trying to sign in. - MTAs using greylisting can cause une…

Also, they only work if I have an e-mail client on the device I'm trying to log in from. Otherwise having to transfer this link becomes a burden.

Additionally, even if I do have the e-mail on my device, clicking the link on mobile often opens it up inside some alternative web-view. Thus the session is tied to my e-mail client, not my actual browser.

Re: Are Magic Links Outdated?

#45

Post by pastage »

MrDunham wrote: post #23

> Email Security: ...Should someone gain access to another user's inbox, they simultaneously receive the keys to logging into profiles that run on magic links. Therefore, a single cyber-attack on your email could lead to unwanted activity on many of your utilized virtual services This statement only partially covers the problem. I once had a cofounder leave my company on bad terms. He had access to the bank accounts,…

I hope you do not use banks that use just email for authentication anymore. Horribly insecure.

Re: Are Magic Links Outdated?

#46

Post by Joker_vD »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow.

I've no idea why it is so difficult for apps to open links in the user-selected browser. Isn't it just "xdg-open https://example.com/"?

Re: Are Magic Links Outdated?

#47

Post by bamboozled »

I think a lot of the complaints here are "nerd problems".

For customers they seem like a super convenient thing, I was just implementing them in my app. Yes magic links have problems and it's probably making me lean more towards the "emailing a code" option now, some of those problems outlined aren't easy to ignore.

The app I'm working on, users would login probably once or twice a year. I just can't imagine they want to deal with passwords, especially because my app is very niche, they'd use it once a year for one thing only. What I can imagine them having to do is constantly use the "forgot my password" feature anyway.

For conversion easy logins are really important.Anyone have any better ideas than magic links, passwords or one time codes in email?

Re: Are Magic Links Outdated?

#48

Post by Mordisquitos »

theginger wrote: post #18
Mordisquitos wrote: post #8

Earlier quoted context omitted.

I don't understand. What would the QR encode? Surely not the magic link itself, as that would defeat the purpose.

I think the idea is to stop mail providers automatically scannings the link, which would work until they start scanning the images for QR codes and scanning the links.

I don't know, GP comment said "rather than email" and not "rather than a link".

Even so, the potential problem caused by email providers automatically calling links in received emails is trivially prevented by having a "Confirm login" button at the destination, as displayed in the visual example in the article. Also, using a QR would then rely on the user having yet another device at hand to log in, perform the often awkward scanning procedure instead of an ordinary couple of clicks/taps... to then finally log in on their phone and not on the original device they were aiming to (as well as making it less secure in a public surrounding against covert attackers in close proximity, but that's a bit of an edge case).

Re: Are Magic Links Outdated?

#50

Post by bamboozled »

pjc50 wrote: post #39

"Opening an email and clicking on a link" is one of the most risky things you can do with your computer; it's a critical stage in many successful security breaches. Why would you train people to do it?

Are you serious?

I'm signing into a website, I get an email when I'm about to sign-in from said domain, I click the link in the email, I'm signed in.

What is this training me to do exactly?

Post reply on HN