Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

111–120 of 230 posts

Re: Are Magic Links Outdated?

#111

Post by joshstrange »

kevincox wrote: post #12
jarsbe wrote: post #7

It depends. I used magic links for a system where the user would log in every 6-12 months. It didn't make sense to force them to make a password.

Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Register: 1. I click the password field. 2. I click "use autogenerated password" 3. Sign up. For login: 1. Click "login". The magic link experience is comparatively awful: 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site…

Need some more straw for your strawman there? I can't take this comment seriously when you misrepresent both approaches so badly.

There are legitimate downsides to magic links but this isn't realistic. Do you not have to enter email on register? Where is the email confirm step for password signup? Finding the tab you just opened and dragging it... really? All of that happens on first signup as well. And the comment you are replying to is talking about a 1-2 times a year process, is a magic link really so difficult to use twice a year?

Re: Are Magic Links Outdated?

#112

Post by contravariant »

movedx wrote: post #69
joe_fishfish wrote: post #10

Earlier quoted context omitted.

If it's magic link or multi-factor authentication, I know which one I prefer. Try explaining to an MFA-loving service that your phone is out of action while it's being repaired.

Microsoft Authenticator - syncs your codes to the Cloud so you can pull them elsewhere (which your phone is out of action.)

Last time I tried that I still had to reactivate all the accounts.

Storing them in Bitwarden is more convenient by far, but storing TOTP is a paid feature.

Re: Are Magic Links Outdated?

#113

Post by Mordisquitos »

amadeuspagel wrote: post #61
dspillett wrote: post #59

Earlier quoted context omitted.

> How would that defeat the purpose? If it is just the magic link then anyone, someone shoulder-surfing as you access the site/app for instance, could scan that code and get in by following the link. If it is being used as a single factor then even worse: anyone can get the QR code to scan without you even being present. QR codes will work in this sort of context, but more work is needed to prove the device scanning…

Yeah. So one possiblity would be to confirm on the other device, where you're already logged in, that you're the one who photographed the QR code.

If you need to be already logged in the device that reads the QR code, then the QR is no longer encoding a magic link. It is more similar to doing the 2nd part of 2FA (after skipping the 1st) but adding unnecessary complexity in between. If we expect the user to be already logged in on a device that they have at hand, why give them a QR code instead of simply a PIN code or a notification to confirm the new login?

Re: Are Magic Links Outdated?

#114

Post by aaaaaaaaata »

pastage wrote: post #45
MrDunham wrote: post #23

> Email Security: ...Should someone gain access to another user's inbox, they simultaneously receive the keys to logging into profiles that run on magic links. Therefore, a single cyber-attack on your email could lead to unwanted activity on many of your utilized virtual services This statement only partially covers the problem. I once had a cofounder leave my company on bad terms. He had access to the bank accounts,…

I hope you do not use banks that use just email for authentication anymore. Horribly insecure.

What bank due you use that's MFA key only, with no easy fallbacks?

Re: Are Magic Links Outdated?

#115

Post by postalrat »

usrn wrote: post #104
postalrat wrote: post #102

Earlier quoted context omitted.

Does that make a password + email password reset a quarter factor?

Password plus email is one factor. So that would be 3/2 factor auth.

Email reset isn't any different than a magic link. Adding an additional password option for login only lowers the security.

Re: Are Magic Links Outdated?

#116

Post by aaaaaaaaaaab »

joshstrange wrote: post #106
aaaaaaaaaaab wrote: post #36

Earlier quoted context omitted.

So if I have 700k usernames I can pwn one of them with 50% probability. Cool! With 3 attempts allowed I only need 230k usernames, even better! The "secret" stored in the browser doesn't protect you from this, since I'm not stealing someone's code; I'm logging in from my own browser. (Of course I'm doing this via a botnet, so you won't notice it by IP address)

I'm pretty sure you are missing how they implementing this. It sounds like at time of the request to send the code the browser either generates and sends to the server (or gets from the server) a longer/more-complicated secret. Both that secret (which is probably account-specific, the one you requested login to) and the 6 digit code are required. You can't just guess the code, the code has to be combined with another…

No, actually I'm pretty sure you are missing why their system is insecure.

But sure, let me explain it:

Step 1: acquire a list of 230 000 usernames/emails.

Step 2: for each username/email, launch a browser and request a login code. The login code is sent to the users' email address, and the super-ultra-secret token is stored in the browser.

Step 3: for each username/email, do 3 random guesses from their respective browsers.

Each guess is a Bernoulli trial with P = 10^-6. Thus the probability of at least one success is 1 - (1 - 10^-6)^(230000 * 3) = 49.8%

I hope this made it clear for you. I think the fallacy in your reasoning was assuming that only legitimate users can get the "secret" token, which is false. It is true for things like debit cards, where the token is stored on the card itself, hence the 4-digit PIN with 3 tries allowed is sufficient. In this case however a "secret" token is handed out to anyone who requests a code. It protects you from someone peeking into your mailbox and stealing your code, but it fails against brute forcing codes on a large number of users.

Re: Are Magic Links Outdated?

#117

Post by tebbers »

clement_b wrote: post #6

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

The problem is that most users still don’t have password managers and actually magic links are more secure for them because they’re not vulnerable to password stuffing.

Re: Are Magic Links Outdated?

#118

Post by aaaaaaaaata »

mffap wrote: post #108
withinboredom wrote: post #42

Earlier quoted context omitted.

Chrome supports a webauthn solution built-in if you don't have windows/platform authentication support. I think Firefox does too, and probably even Safari on really old machines. If you are targeting semi-modern browsers and devices made in the last 5-10 years, you should be fine.

Yes. To my knowledge WebAuthN works great on Chrome, Safari, Firefox (most times) on MacOS/iOS and Windows devices. Linux is still an issue unfortunately as it seems.

Opposite of what I'd expect.

Re: Are Magic Links Outdated?

#119

Post by ammmir »

mojuba wrote: post #19

Another relatively new problem with magic links specifically on mobile is that your email client will likely open the link in an embedded browser which is typically isolated from the main browser app and doesn't share the cookies with it. There are some workarounds for this but they don't seem very secure, plus they add some complexity. E.g. once the backend validates the magic link click, it logs the user in also in…

The way I've implemented in one of my own projects [1] but that I'm not fully happy with (and the way that Amazon.com does it) is to do what you suggest: create a record on the backend when the login attempt begins and have your frontend keep checking that record until there is a result like email verified/not-verified/timed-out. When the user clicks the magic link in the email, update that record with their choice to approve or reject the login, or ultimately time out and invalidate the login attempt. This avoids the separate cookie jar problem.

The phishing scenario is a real one, though. People have been conditioned to click Yes on everything. Coinbase's magic links implementation, for example, requires you to click the magic link in the same browser session that initiated the login. This is a bit more secure, although annoying from a UX perspective if you're in an embedded WebView like you mentioned.

The middle ground is something like instead of sending a link, send a code via email that you enter on the website, but that just removes the magic of magic links and is no different than what it was before!

[1] https://loginwith.xyz

Re: Are Magic Links Outdated?

#120

Post by kevincox »

joshstrange wrote: post #111
kevincox wrote: post #12

Earlier quoted context omitted.

Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Register: 1. I click the password field. 2. I click "use autogenerated password" 3. Sign up. For login: 1. Click "login". The magic link experience is comparatively awful: 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site…

Need some more straw for your strawman there? I can't take this comment seriously when you misrepresent both approaches so badly. There are legitimate downsides to magic links but this isn't realistic. Do you not have to enter email on register? Where is the email confirm step for password signup? Finding the tab you just opened and dragging it... really? All of that happens on first signup as well. And the comment y…

> Do you not have to enter email on register?

Yes, I have omitted this from both workflows.

> Where is the email confirm step for password signup?

Good point, most websites will want to confirm the email address. I didn't include that.

> Finding the tab you just opened and dragging it... really?

Yes, I like to keep my tabs organized. I'm not even a tree-sytle-tabs user but at least want to get the right window. The point is that magic links disrupt my in-browser workflow with switching between apps and opening links in new tabs.

> is a magic link really so difficult to use twice a year?

No, but it is still more difficult than a password multiple times a year. Neither of these have a yearly cost so it doesn't really matter how often you do them. I wouldn't use "only twice a year" to justify that people can come to our office in person to authenticate over a magic link.

Post reply on HN