Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

121–130 of 230 posts

Re: Are Magic Links Outdated?

#121

Post by hardware2win »

dijonman2 wrote: post #53
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

It’s just like anti-CSRF tokens, lots of edge cases and it’s hard to get right. I don’t have a pw manager on my mobile device nor do I want one, getting a 35+ char into an input field on my phone is a PITA.

Whats so hard about anti csrf tokens?

Re: Are Magic Links Outdated?

#122

Post by ninkendo »

adrr wrote: post #89
mooreds wrote: post #41

Earlier quoted context omitted.

Lots of issues with magic links. And yet, and yet. For a certain class of accounts, I'm okay deferring to my email inbox. From a security perspective as a user, it's no different than deferring to a social provider like Google, but has the benefit in that it gives a user more control over the third party they choose to delegate control to. You allow username/password access and that's great too. I'm a fan of giving u…

If the high value account does password resets via email a magic link email is no less secure. Even banks do password resets by email but combine it with private info like SSN which really isn't private due to all the breaches like equinox. Email is the master key to most of your accounts.

> Email is the master key to most of your accounts.

I’ve been mulling over ideas for this in my head for a while, about fully standardizing the magic-link-to-login approach as a full single-sign-on implementation.

Sites could craft an email with a specific header scheme that denotes what it’s trying to do, for what website, and what the magic link key is. The body of the email would still look like a regular magic link email as it does today, as a graceful fallback behavior.

The website login screen could detect if the user agent supported magic links (best way to do this detection is TBD…), the requirements being be that (a) The OS has an email account configured for the user (like via Mail.app or similar), and (b) the OS can broker the security information of the magic links to the browser so that it doesn’t need “full” access to your email, just a standardized API for the browser to get the magic link header info.

If everything checks out, the UX for the login page would be:

- User: enters email address to log in with, hits submit

- Webpage: renders a quick loading spinner

- Website: Sends a magic link email to the email address

- OS: Sees the special magic link email and notices that the browser is in focus on the same origin (using an origin policy that requires the magic link’s headers matches the same origin as the page)

- Browser: Gets magic link/token from the OS

- Browser: Submits token to website

- User sees the login succeed.

- (Optional:) The mail client puts the email itself in a trash folder or some other place so the user doesn’t even notice it (although they should be able to dig it up if they want.)

The graceful fallback if the browser/OS setup is not supported would be that the website just renders the same “check your email for a link” page it would have normally sent.

Apple has enough integration to easily implement this on iOS and macOS, it would be great to see this happen. They already implement autofill for security codes sent to SMS or email, so they already have a similar level of integration, it just needs to be made seamless and not even require user input. It could also be a totally open standard so that any OS/desktop environment/etc could implement it.

Re: Are Magic Links Outdated?

#123

Post by joshstrange »

kevincox wrote: post #120
joshstrange wrote: post #111

Earlier quoted context omitted.

Need some more straw for your strawman there? I can't take this comment seriously when you misrepresent both approaches so badly. There are legitimate downsides to magic links but this isn't realistic. Do you not have to enter email on register? Where is the email confirm step for password signup? Finding the tab you just opened and dragging it... really? All of that happens on first signup as well. And the comment y…

> Do you not have to enter email on register? Yes, I have omitted this from both workflows. > Where is the email confirm step for password signup? Good point, most websites will want to confirm the email address. I didn't include that. > Finding the tab you just opened and dragging it... really? Yes, I like to keep my tabs organized. I'm not even a tree-sytle-tabs user but at least want to get the right window. The p…

> > Do you not have to enter email on register?

> Yes, I have omitted this from both workflows.

You specifically complained about having to enter your email on the magic link flow:

> 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site email address.

> > is a magic link really so difficult to use twice a year?

> No, but it is still more difficult than a password multiple times a year. Neither of these have a yearly cost so it doesn't really matter how often you do them. I wouldn't use "only twice a year" to justify that people can come to our office in person to authenticate over a magic link.

Yearly costs to who? The user? I guess there isn't really a cost to them other than storing/keeping the password but there is absolutely a cost to the developer and I'm not talking about the cost of storing a hashed/salted password in the DB itself. There is a cost to build and maintain a password-based system. It means implementing and maintaining a number of things like your salt, password complexity requirements, password reset flow, and more like you going to use something like HaveIBeenPwned's hash list to make sure people aren't using known passwords?

Passwords are not zero-cost and have ongoing concerns. I'm not saying magic links are always or even often the best choice, just that they do have a perfectly valid use-case.

Re: Are Magic Links Outdated?

#124

Post by silversmith »

RulerOf wrote: post #95
pritambaral wrote: post #63

Earlier quoted context omitted.

> Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. The earliest Magic Links I remember using didn't have this problem, and this was before smartphones. The Link, back then at least, was only to authenticate that you can receive emails at a certain mailb…

>Your login attempt would keep the login (not logged-in) session open wherever you attempted to login from While I generally agree that this behavior is correct from a usability standpoint, it's not safe. That design allows a user to do a one-click account compromise when they receive a magic link that was sent in response to the login attempt of an attacker that happened to know the user's email address.

So add a step that requires "knowledge transfer" between the login device and confirmation device. Microsoft does this in their authenticator app showing essentially three confirmation buttons with different numbers on them, and requiring you to press the one being shown on the login screen. Worst case you now have one-in-three-clicks account compromise rater than one-click. And hopefully this also causes the user to ask why they are being required to log in if the app is not displaying the confirmation data.

Re: Are Magic Links Outdated?

#125

Post by snovv_crash »

Joker_vD wrote: post #46
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

Uninstall chrome and use Firefox, and it works for me with full cookie sharing. There is even an "open in Firefox" in the hamburger drop-down which transfers the page to the browser app without reloading.

Re: Are Magic Links Outdated?

#126

Post by maccard »

Joker_vD wrote: post #46
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

> I've no idea why it is so difficult for apps to open links in the user-selected browser.

It's not, it's a conscious decision to open links in chrome from gmail.

Re: Are Magic Links Outdated?

#127

Post by kevincox »

joshstrange wrote: post #123
kevincox wrote: post #120

Earlier quoted context omitted.

> Do you not have to enter email on register? Yes, I have omitted this from both workflows. > Where is the email confirm step for password signup? Good point, most websites will want to confirm the email address. I didn't include that. > Finding the tab you just opened and dragging it... really? Yes, I like to keep my tabs organized. I'm not even a tree-sytle-tabs user but at least want to get the right window. The p…

> > Do you not have to enter email on register? > Yes, I have omitted this from both workflows. You specifically complained about having to enter your email on the magic link flow: > 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site email address. > > is a magic link really so difficult to use twice a year? > No, but it…

> You specifically complained about having to enter your email on the magic link flow:

For logins yes:

> My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site email address.

My email always autofills for regular login forms. Maybe this is a bug in my browser but either way it is an inconvenience that I face.

> implementing and maintaining a number of things like your salt, password complexity requirements, password reset flow

If you are using any halfway popular language there is a library that does all of this for you. In fact it is probably easier to use a pre-packaged library than for magic links, but I'm sure those libraries could appear if magic links become more popular.

Re: Are Magic Links Outdated?

#128

Post by Spooky23 »

Magic links are great for low trust model applications where the user is required to use the app but is a limited stakeholder.

Case in point: SportSignUp, which is a platform/app that allows you to manage your little league/basketball/soccer team, etc.

The use cases for parents are basically figuring out where games/practices are, telling coaches that they will be/not be there, checking scores, and signing up to volunteer for various tasks.

Life is complex. You have non-custodial parents, nannys, older siblings, etc helping out. The easiest path is to send the magic link to the family text group.

Re: Are Magic Links Outdated?

#129

Post by gorjusborg »

lostmsu wrote: post #78
movedx wrote: post #69

Earlier quoted context omitted.

Microsoft Authenticator - syncs your codes to the Cloud so you can pull them elsewhere (which your phone is out of action.)

Doesn't that defeat the purpose to a degree?

I use MS authenticator, and had the same thought.

I came to grips with the idea that I really don't care all that much if a single factor has risks as long as the other factors have orthogonal lists.

Re: Are Magic Links Outdated?

#130

Post by eru »

snovv_crash wrote: post #125
Joker_vD wrote: post #46

Earlier quoted context omitted.

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

Uninstall chrome and use Firefox, and it works for me with full cookie sharing. There is even an "open in Firefox" in the hamburger drop-down which transfers the page to the browser app without reloading.

As an added bonus, Firefox on Android also support ublock origin.
Post reply on HN