Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

81–90 of 230 posts

Re: Are Magic Links Outdated?

#81

Post by thdxr »

ncallaway wrote: post #79
pritambaral wrote: post #63

Earlier quoted context omitted.

> Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. The earliest Magic Links I remember using didn't have this problem, and this was before smartphones. The Link, back then at least, was only to authenticate that you can receive emails at a certain mailb…

I just recently implemented a magic link flow for a project I’m working on, and “authenticated in the originating browser” was a high priority item for me. I think it’s just so much nicer of an experience to not have to worry where you go check the email or which browser opens when you click the link there. The site you used to login was clearly where you intended to be, so that should definitely be one of the authen…

The issue I ran into with this was I could initiate a login for anyone and if they accidentally hit the link I could remote login.

Switched to pin code entry, less fancy but achieves all the desired UX

Re: Are Magic Links Outdated?

#82

Post by andybak »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

> MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser.

It might be howling into the void but the conclusion I reach from this is that "Mobile email clients are a nightmare".

Generally speaking, embedded browsers in mobile apps are a terrible idea and break user expectations in multiple ways.

Re: Are Magic Links Outdated?

#83

Post by rakoo »

lostmsu wrote: post #78
movedx wrote: post #69

Earlier quoted context omitted.

Microsoft Authenticator - syncs your codes to the Cloud so you can pull them elsewhere (which your phone is out of action.)

Doesn't that defeat the purpose to a degree?

There needs to be a way to sync everywhere except the device you're connecting from

Re: Are Magic Links Outdated?

#84

Post by ncallaway »

thdxr wrote: post #81
ncallaway wrote: post #79

Earlier quoted context omitted.

I just recently implemented a magic link flow for a project I’m working on, and “authenticated in the originating browser” was a high priority item for me. I think it’s just so much nicer of an experience to not have to worry where you go check the email or which browser opens when you click the link there. The site you used to login was clearly where you intended to be, so that should definitely be one of the authen…

The issue I ran into with this was I could initiate a login for anyone and if they accidentally hit the link I could remote login. Switched to pin code entry, less fancy but achieves all the desired UX

I think that’s totally fair. The site I’m working on is pretty low stakes from a security perspective (a private personal blog), with less technical people in the audience, so I was willing to make that trade off for the UX outcome I wanted, but that was specific to the damage of a breach in my specific use case.

Re: Are Magic Links Outdated?

#85

Post by DocTomoe »

bamboozled wrote: post #47

I think a lot of the complaints here are "nerd problems". For customers they seem like a super convenient thing, I was just implementing them in my app. Yes magic links have problems and it's probably making me lean more towards the "emailing a code" option now, some of those problems outlined aren't easy to ignore. The app I'm working on, users would login probably once or twice a year. I just can't imagine they wan…

I quit using services that have magic links as their only authorisation method - and so does my 65 year old, very non-nerdy mother (she complains about 'having to wait for a damn email' all the time)

> Anyone have any better ideas than magic links, passwords or one time codes in email?

Passwords. Password managers are not a new concept, they have been around for decades by now, have deep browser integration (either because they often are part of the browser, or in the case of Apple, the OS), and are easily understood by users.

Re: Are Magic Links Outdated?

#86

Post by DocTomoe »

kevincox wrote: post #12
jarsbe wrote: post #7

It depends. I used magic links for a system where the user would log in every 6-12 months. It didn't make sense to force them to make a password.

Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Register: 1. I click the password field. 2. I click "use autogenerated password" 3. Sign up. For login: 1. Click "login". The magic link experience is comparatively awful: 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site…

> Why not? Most browsers are slowing pushing password managers on users and the experience is lovely.

Most browsers in 1996 had "save this password" functionality... it's not a new thing.

Re: Are Magic Links Outdated?

#87

Post by ajvs »

clement_b wrote: post #6

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

Yeah this is a huge turn off when using Notion especially.

Re: Are Magic Links Outdated?

#88

Post by kevincox »

DocTomoe wrote: post #86
kevincox wrote: post #12

Earlier quoted context omitted.

Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Register: 1. I click the password field. 2. I click "use autogenerated password" 3. Sign up. For login: 1. Click "login". The magic link experience is comparatively awful: 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site…

> Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Most browsers in 1996 had "save this password" functionality... it's not a new thing.

I think it has gotten more aggressive with popups to use a generated password appearing any time you focus a password field.

Re: Are Magic Links Outdated?

#89

Post by adrr »

mooreds wrote: post #41
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

Lots of issues with magic links. And yet, and yet. For a certain class of accounts, I'm okay deferring to my email inbox. From a security perspective as a user, it's no different than deferring to a social provider like Google, but has the benefit in that it gives a user more control over the third party they choose to delegate control to. You allow username/password access and that's great too. I'm a fan of giving u…

If the high value account does password resets via email a magic link email is no less secure. Even banks do password resets by email but combine it with private info like SSN which really isn't private due to all the breaches like equinox.

Email is the master key to most of your accounts.

Re: Are Magic Links Outdated?

#90

Post by IggleSniggle »

pritambaral wrote: post #63
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

> Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. The earliest Magic Links I remember using didn't have this problem, and this was before smartphones. The Link, back then at least, was only to authenticate that you can receive emails at a certain mailb…

As a user the problem I run into with some frequency is passwordless login where the waiting session loses its “waiting” status because I switched the active application in iOS from my browser to my email and back again. When I get back, the page for whatever reason (refresh after being backgrounded?) requires a new auth attempt.

A wrinkle in this complaint is that in most scenarios I don’t especially want a browser tab to be able to hold onto a persistent session while it’s closed due to privacy reasons, regardless of where that session state is held (and I realize there are a number of options).

Post reply on HN