Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

131–140 of 230 posts

Re: Are Magic Links Outdated?

#131

Post by aaaaaaaaaaab »

Isinlor wrote: post #51
aaaaaaaaaaab wrote: post #36

Earlier quoted context omitted.

So if I have 700k usernames I can pwn one of them with 50% probability. Cool! With 3 attempts allowed I only need 230k usernames, even better! The "secret" stored in the browser doesn't protect you from this, since I'm not stealing someone's code; I'm logging in from my own browser. (Of course I'm doing this via a botnet, so you won't notice it by IP address)

With passwords you will get even higher probability if you just try 100 most popular passwords allowed by the service on hundreds of thousands of users. Try making password creation too difficult and now password reset will be the default authentication for a lot of users anyway.

The 100 most popular passwords should already be blacklisted during registration, so it wouldn't be possible to set them as your password.

I have nothing against password-reset-as-authentication aka "magic links", when done properly. And by properly I mean not using an ultra-low entropy auth code, like the parent is proposing (6 decimal digits, aka 20 bits of entropy).

Re: Are Magic Links Outdated?

#132

Post by lkbm »

andybak wrote: post #82
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

> MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. It might be howling into the void but the conclusion I reach from this is that "Mobile email clients are a nightmare". Generally speaking, embedded browsers in mobile apps are a terrible idea and break user expectations in multiple ways.

> It might be howling into the void but the conclusion I reach from this is that "Mobile email clients are a nightmare".

This is true, and as a user I want something better, but as a developer I need to build for what our users use.

I don't put "Site best viewed in Netscape Navigator", and I don't tell users they can only login on desktop.

Re: Are Magic Links Outdated?

#133

Post by dymk »

joe_fishfish wrote: post #10
clement_b wrote: post #6

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

If it's magic link or multi-factor authentication, I know which one I prefer. Try explaining to an MFA-loving service that your phone is out of action while it's being repaired.

1password and Lastpass both manage MFA codes and work cross-device. If your phone is your only way to get into MFA protected accounts, you're doing it wrong. What happens if you can't repair your phone?

Re: Are Magic Links Outdated?

#134

Post by DocTomoe »

joshstrange wrote: post #123
kevincox wrote: post #120

Earlier quoted context omitted.

> Do you not have to enter email on register? Yes, I have omitted this from both workflows. > Where is the email confirm step for password signup? Good point, most websites will want to confirm the email address. I didn't include that. > Finding the tab you just opened and dragging it... really? Yes, I like to keep my tabs organized. I'm not even a tree-sytle-tabs user but at least want to get the right window. The p…

> > Do you not have to enter email on register? > Yes, I have omitted this from both workflows. You specifically complained about having to enter your email on the magic link flow: > 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site email address. > > is a magic link really so difficult to use twice a year? > No, but it…

> but there is absolutely a cost to the developer and I'm not talking about the cost of storing a hashed/salted password in the DB itself. There is a cost to build and maintain a password-based system.

Seriously ... if today's developers are unable or unwilling to learn about basic hashing/salting and database storage/value comparison, and consider such concepts 'costly' ... we may have passed the zenith of technological advancement, and are in a 'downfall of the Roman Empire' phase. Have some pride in your work.

> It means implementing and maintaining a number of things like your salt, password complexity requirements, password reset flow, and more like you going to use something like HaveIBeenPwned's hash list to make sure people aren't using known passwords?

Do you reinvent the wheel whenever you need to drive somewhere? these things mostly are already baked into most frameworks, and if they are not, most developers build something like this once, and reuse.

> [Magic Links] they do have a perfectly valid use-case.

Annoying customers and forcing them out of your business into the willing hands of your competition?

Re: Are Magic Links Outdated?

#135

Post by lkbm »

ninkendo wrote: post #122
adrr wrote: post #89

Earlier quoted context omitted.

If the high value account does password resets via email a magic link email is no less secure. Even banks do password resets by email but combine it with private info like SSN which really isn't private due to all the breaches like equinox. Email is the master key to most of your accounts.

> Email is the master key to most of your accounts. I’ve been mulling over ideas for this in my head for a while, about fully standardizing the magic-link-to-login approach as a full single-sign-on implementation. Sites could craft an email with a specific header scheme that denotes what it’s trying to do, for what website, and what the magic link key is. The body of the email would still look like a regular magic li…

I was recently thinking something similar for implementing a 2fa similar to how Google and Apple do it: pop up a notification on your phone asking "Is this login you?"

Throw some structured data into the email. Email clients can detect and do the popup that hits a callback endpoint. Clients that don't support it still get the code via regular email.

I avoid the OS-layer implementation at the expense of the user having to confirm it's them, but this also means it works cross-device, which is what I'd want for 2fa anyway.

Re: Are Magic Links Outdated?

#136

Post by DocTomoe »

yababa_y wrote: post #2

They don’t seem that outdated to me, given the evidence presented. email provider security is a real problem but is usually considered the root of trust for persons…

One of the first things I learned when I got onto the internet was that "consider (RFC822) emails to be postcards analogs, readable by anyone who stumbles over them, they are not like mail which hides its content in an envelope." That was in 1994. Shirts reading "I read your email" were popular with the IT guys up to until about ten years ago (and they are still being offered).

Email is an inherently insecure, non-trustworthy system. Considering it the "root of trust" sounds scary.

Re: Are Magic Links Outdated?

#137

Post by rambambram »

roelschroeven wrote: post #56
bamboozled wrote: post #50

Earlier quoted context omitted.

Are you serious? I'm signing into a website, I get an email when I'm about to sign-in from said domain, I click the link in the email, I'm signed in. What is this training me to do exactly?

Some third party detects you're trying to sign into a website. The third party sends you an email, that email happens to arrive first. You click the link in the email. Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party. Apparently things like this do happen, for example when people are buying or selling things on the…

> Some third party detects you're trying to sign into a website.

And this third party can find out how, exactly?

Re: Are Magic Links Outdated?

#138

Post by mooreds »

ninkendo wrote: post #122
adrr wrote: post #89

Earlier quoted context omitted.

If the high value account does password resets via email a magic link email is no less secure. Even banks do password resets by email but combine it with private info like SSN which really isn't private due to all the breaches like equinox. Email is the master key to most of your accounts.

> Email is the master key to most of your accounts. I’ve been mulling over ideas for this in my head for a while, about fully standardizing the magic-link-to-login approach as a full single-sign-on implementation. Sites could craft an email with a specific header scheme that denotes what it’s trying to do, for what website, and what the magic link key is. The body of the email would still look like a regular magic li…

What is the win of this over webauthn (if the website supports it)? I guess the big win is that the graceful fallback is smoother.

Seems like a lot of moving pieces that only an OS vendor (who controls both the browser and the email client and could build the integration between them) could implement.

Re: Are Magic Links Outdated?

#139

Post by patwolf »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

I worked on a project where we used magic links (using Firebase) for users to checkin at an event using an app. It was a disaster.

For a lot of users the link didn't open in the app the way it was supposed to. Another surprisingly large subset of users had two phones, but the app wasn't on the phone they used for email. A one-time code definitely would have been better than a link.

Re: Are Magic Links Outdated?

#140

Post by Lorin »

kaichanvong wrote: post #35
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

yeah on Discord this is almost magic.

I really like the QR code system they implemented, pretty handy
Post reply on HN