Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

51–60 of 230 posts

Re: Are Magic Links Outdated?

#51

Post by Isinlor »

aaaaaaaaaaab wrote: post #36
bradgessler wrote: post #30

I wrote a Rails plugin for magic links at https://github.com/rocketshipio/nopassword that doesn’t suffer from many of the problems I’m seeing in the comments. The big thing is I only use a 6 digit numerical code that people have to copy and paste or type into the browser which they’re authenticating. I looked at stuffing a token into a URL, but it’s not a good idea because the email client may try opening the link to…

So if I have 700k usernames I can pwn one of them with 50% probability. Cool! With 3 attempts allowed I only need 230k usernames, even better! The "secret" stored in the browser doesn't protect you from this, since I'm not stealing someone's code; I'm logging in from my own browser. (Of course I'm doing this via a botnet, so you won't notice it by IP address)

With passwords you will get even higher probability if you just try 100 most popular passwords allowed by the service on hundreds of thousands of users.

Try making password creation too difficult and now password reset will be the default authentication for a lot of users anyway.

Re: Are Magic Links Outdated?

#52

Post by bamboozled »

ricardo81 wrote: post #29

The article doesn't seem to cover a potential issue- updating an email address associated with an account (2FA aside). If you've somehow lost access to email, a typical pattern is that you can login to your account, update the username and receive a validation email at the new address to confirm its validity.

"Contact support to update your email"?

Re: Are Magic Links Outdated?

#53

Post by dijonman2 »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

It’s just like anti-CSRF tokens, lots of edge cases and it’s hard to get right.

I don’t have a pw manager on my mobile device nor do I want one, getting a 35+ char into an input field on my phone is a PITA.

Re: Are Magic Links Outdated?

#54

Post by amadeuspagel »

Mordisquitos wrote: post #8
amadeuspagel wrote: post #3

I've been thinking about magic links using QR codes rather then email. EDIT: The idea here is that on a device where you're already logged in you generate a QR code, you photograph that code on another device, and then you confirm on the first device that it's really you who photographed the code on the other device.

I don't understand. What would the QR encode? Surely not the magic link itself, as that would defeat the purpose.

Yes of course the magic link itself. How would that defeat the purpose?

Re: Are Magic Links Outdated?

#55

Post by mooreds »

capableweb wrote: post #5

Article fails to mention that "Magic Links" are not only possible via email, but any out-of-band method, so you could use Whatsapp, Telegram or IRC even. Obviously, the user is assumed to have a secure setup regarding whatever method you send the link via. Which the "Email Security" section kind of hints to as well, that it's important users have a secure email setup. What they fail to mention, is that this is import…

> "honest look on how "Magic Links" can be made more secure"

Challenge accepted. Here's my best practice list. (I should put this into a blog post!)

* Prefer them for accounts that are infrequently used or low risk.

* Test for conversion or goal uplift if possible with this.

* Offer the user choices; some people will prefer username/password, some magic link, some social sign-on.

* Ensure that users understand that whatever the destination is (email, whatsapp, slack, etc), the security of their app account is now tied to the destination's security. Understand that most folks care far more about their email or other destination than they do about access to your app.

* Understand the UX tradeoffs (around mobile browser issues). Document them if possible

* Make sure everything is over HTTPS. (Duh :) ).

* Set timeouts for links appropriately and communicate that to your users. ("This link is good for X minutes." "This link expires at HH:MM.")

* Warn users that access to the link is the same as access to the account. "Don't forward this email".

I think that's everything I'd say. I would love to hear if I missed something.

Re: Are Magic Links Outdated?

#56

Post by roelschroeven »

bamboozled wrote: post #50
pjc50 wrote: post #39

"Opening an email and clicking on a link" is one of the most risky things you can do with your computer; it's a critical stage in many successful security breaches. Why would you train people to do it?

Are you serious? I'm signing into a website, I get an email when I'm about to sign-in from said domain, I click the link in the email, I'm signed in. What is this training me to do exactly?

Some third party detects you're trying to sign into a website. The third party sends you an email, that email happens to arrive first. You click the link in the email. Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party.

Apparently things like this do happen, for example when people are buying or selling things on the internet. They get redirected to a pay processing site that looks just like the one from their bank, but steals their money and/or identity instead.

Re: Are Magic Links Outdated?

#57

Post by dspillett »

Mordisquitos wrote: post #8
amadeuspagel wrote: post #3

I've been thinking about magic links using QR codes rather then email. EDIT: The idea here is that on a device where you're already logged in you generate a QR code, you photograph that code on another device, and then you confirm on the first device that it's really you who photographed the code on the other device.

I don't understand. What would the QR encode? Surely not the magic link itself, as that would defeat the purpose.

If the user's phone's browser knows a relevant secret (a pre-shared key or the private half of a key-pair the other side has the public half saved in), then the QR code is a magic link. Scanning the code opens the page in the browser, that page reads the secret (client-side only obviously) and uses it to sign a second request.

Requires a setup step first that the magic link doesn't (getting the secret stored in the browser).

Also no use if the user is trying to login with that particular device.

Re: Are Magic Links Outdated?

#58

Post by wohfab »

bamboozled wrote: post #47

I think a lot of the complaints here are "nerd problems". For customers they seem like a super convenient thing, I was just implementing them in my app. Yes magic links have problems and it's probably making me lean more towards the "emailing a code" option now, some of those problems outlined aren't easy to ignore. The app I'm working on, users would login probably once or twice a year. I just can't imagine they wan…

I mean, the magic link could be an addition to the "forgot password" screen, then? As in "reset password or login via magic link"?

Re: Are Magic Links Outdated?

#59

Post by dspillett »

amadeuspagel wrote: post #54
Mordisquitos wrote: post #8

Earlier quoted context omitted.

I don't understand. What would the QR encode? Surely not the magic link itself, as that would defeat the purpose.

Yes of course the magic link itself. How would that defeat the purpose?

> How would that defeat the purpose?

If it is just the magic link then anyone, someone shoulder-surfing as you access the site/app for instance, could scan that code and get in by following the link.

If it is being used as a single factor then even worse: anyone can get the QR code to scan without you even being present.

QR codes will work in this sort of context, but more work is needed to prove the device scanning the code is the user's device and not some random's - you can't just use a straight single request following the magic link as credentials.

Re: Are Magic Links Outdated?

#60

Post by daveoc64 »

roelschroeven wrote: post #56
bamboozled wrote: post #50

Earlier quoted context omitted.

Are you serious? I'm signing into a website, I get an email when I'm about to sign-in from said domain, I click the link in the email, I'm signed in. What is this training me to do exactly?

Some third party detects you're trying to sign into a website. The third party sends you an email, that email happens to arrive first. You click the link in the email. Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party. Apparently things like this do happen, for example when people are buying or selling things on the…

I'm not sure what actual security risk you're talking about here.

I click the magic link, expecting it to sign me in, but instead it takes me to a fake copy of the website which then asks (again) for login details?

Post reply on HN