Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

61–70 of 230 posts

Re: Are Magic Links Outdated?

#61

Post by amadeuspagel »

dspillett wrote: post #59
amadeuspagel wrote: post #54

Earlier quoted context omitted.

Yes of course the magic link itself. How would that defeat the purpose?

> How would that defeat the purpose? If it is just the magic link then anyone, someone shoulder-surfing as you access the site/app for instance, could scan that code and get in by following the link. If it is being used as a single factor then even worse: anyone can get the QR code to scan without you even being present. QR codes will work in this sort of context, but more work is needed to prove the device scanning…

Yeah. So one possiblity would be to confirm on the other device, where you're already logged in, that you're the one who photographed the QR code.

Re: Are Magic Links Outdated?

#62

Post by bob1029 »

I think magic links have some give/take depending on your product/platform/audience.

One major use case that comes up more frequently is onboarding an untrusted device with a trusted one. WhatsApp seems to have mastered this class of problem using the QR code. Typing in codes and clicking emailed links is nice until you feel your phone's camera instantly log you in on your laptop by scanning its screen. The obvious downside is that this is a chicken-egg situation and you have to already have one chicken (or egg) to make it work.

Re: Are Magic Links Outdated?

#63

Post by pritambaral »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

> Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration.

The earliest Magic Links I remember using didn't have this problem, and this was before smartphones. The Link, back then at least, was only to authenticate that you can receive emails at a certain mailbox, not to authenticate whichever browser you used to open it. Your login attempt would keep the login (not logged-in) session open wherever you attempted to login from, while waiting for the Magic Link to be clicked on in the background. Whenever the Magic Link was clicked, irrespective of where it was clicked, your original browser session would stop waiting and log you in.

This also avoids the tedium of having to copy a link or code from one device/app to another. Just click, a browser tab/window opens for a short time, and then closes automatically after doing its job; you go back to wherever you attempted to log in, and simply proceed. This also simplifies post-login flows (like visiting a specific page you tried to access before being forced to login) in that such flows don't need to be tied to the Magic Link itself.

Re: Are Magic Links Outdated?

#64

Post by pritambaral »

matsemann wrote: post #44
sborsje wrote: post #33

There's a near-infinite amount of not-so-small gotchas when implementing magic links: - If magic links are the only way to sign in, authentication success rate is now directly tied to your email deliverability rate. - Single-use tokens (immediately expiring after clicking) can be followed by spam filters, and thus immediately become invalid for the actual user trying to sign in. - MTAs using greylisting can cause une…

Also, they only work if I have an e-mail client on the device I'm trying to log in from. Otherwise having to transfer this link becomes a burden. Additionally, even if I do have the e-mail on my device, clicking the link on mobile often opens it up inside some alternative web-view. Thus the session is tied to my e-mail client, not my actual browser.

This wouldn't be a problem if the Magic Link was used only to authenticate your original login session, and not to start a new session wherever it was opened. Like I mention here: https://news.ycombinator.com/item?id=32081608

Re: Are Magic Links Outdated?

#65

Post by timwis »

sborsje wrote: post #33

There's a near-infinite amount of not-so-small gotchas when implementing magic links: - If magic links are the only way to sign in, authentication success rate is now directly tied to your email deliverability rate. - Single-use tokens (immediately expiring after clicking) can be followed by spam filters, and thus immediately become invalid for the actual user trying to sign in. - MTAs using greylisting can cause une…

Great points! The deliverability (and delay) issue is the one I’ve found most challenging. For the others, here are some mitigations I’ve come across:

- instead of single use tokens, set them to expire within 60 mins

- to prevent spam/malware checkers signing in when following the links, have the magic link take you to a page with a sign in button to ‘complete’ the sign in process. And, optionally, add some JS that clicks it for you on page load. This is the same approach used for unsubscribe links.

Re: Are Magic Links Outdated?

#66

Post by daveoc64 »

pritambaral wrote: post #63
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

> Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. The earliest Magic Links I remember using didn't have this problem, and this was before smartphones. The Link, back then at least, was only to authenticate that you can receive emails at a certain mailb…

I think this is an important point that is often overlooked.

I can quickly access email on my phone - that doesn't necessarily mean I want to log in on my phone.

Re: Are Magic Links Outdated?

#67

Post by OJFord »

daveoc64 wrote: post #60
roelschroeven wrote: post #56

Earlier quoted context omitted.

Some third party detects you're trying to sign into a website. The third party sends you an email, that email happens to arrive first. You click the link in the email. Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party. Apparently things like this do happen, for example when people are buying or selling things on the…

I'm not sure what actual security risk you're talking about here. I click the magic link, expecting it to sign me in, but instead it takes me to a fake copy of the website which then asks (again) for login details?

Yes, a lot of people will fall for that.

Re: Are Magic Links Outdated?

#68

Post by pottertheotter »

One of my healthcare providers uses this and I abhor it. With their website I can see appointments, billing, etc., but instead of simply going to the website and logging in with 1Password, I have to go to the website, enter my email and click log in, switch to my email and wait for the email, open the email and click the link which takes me back to my browser.

It drives me nuts.

Re: Are Magic Links Outdated?

#69

Post by movedx »

joe_fishfish wrote: post #10
clement_b wrote: post #6

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

If it's magic link or multi-factor authentication, I know which one I prefer. Try explaining to an MFA-loving service that your phone is out of action while it's being repaired.

Microsoft Authenticator - syncs your codes to the Cloud so you can pull them elsewhere (which your phone is out of action.)

Re: Are Magic Links Outdated?

#70

Post by wongarsu »

mooreds wrote: post #41
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

Lots of issues with magic links. And yet, and yet. For a certain class of accounts, I'm okay deferring to my email inbox. From a security perspective as a user, it's no different than deferring to a social provider like Google, but has the benefit in that it gives a user more control over the third party they choose to delegate control to. You allow username/password access and that's great too. I'm a fan of giving u…

From a security perspective, most passwords can be reset by email, so sending a magic link or code to the email has approximately the same security properties.

The only real difference is if the password reset forces you to change the password and logs you out everywhere, then you can at least detect the break-in more quickly with the password approach.

Post reply on HN