Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

161–170 of 230 posts

Re: Are Magic Links Outdated?

#161

Post by adrr »

mooreds wrote: post #138
ninkendo wrote: post #122

Earlier quoted context omitted.

> Email is the master key to most of your accounts. I’ve been mulling over ideas for this in my head for a while, about fully standardizing the magic-link-to-login approach as a full single-sign-on implementation. Sites could craft an email with a specific header scheme that denotes what it’s trying to do, for what website, and what the magic link key is. The body of the email would still look like a regular magic li…

What is the win of this over webauthn (if the website supports it)? I guess the big win is that the graceful fallback is smoother. Seems like a lot of moving pieces that only an OS vendor (who controls both the browser and the email client and could build the integration between them) could implement.

Webauth authenticates the device. Still need a way to authenticate the user then you can use webauth going forward on the device. This is assuming you’re using the TPM chip on the device and another FIDO2 device. Standard user won’t have a FIDO2 device like a yubikey but if their phone or computer is relatively new, they will have a TPM chip.

Re: Are Magic Links Outdated?

#162

Post by yesbabyyes »

SkeuomorphicBee wrote: post #99
pritambaral wrote: post #63

Earlier quoted context omitted.

> Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. The earliest Magic Links I remember using didn't have this problem, and this was before smartphones. The Link, back then at least, was only to authenticate that you can receive emails at a certain mailb…

That seems extremely unsafe, email being what email is, there are many layers of automation that may access that link unprompted: a spam/virus filter on the server or the client may access it to verify it is not some malware, a email client may access it to preload assets, etc. So if a malicious actor starts a login on one of my accounts, and somewhere along my email chain-of-custody/stack a helpful software access t…

A site could mitigate this by responding with a form to be posted, asking the user to click a button to verify. Only the POST request after user interaction would verify the email address.

Re: Are Magic Links Outdated?

#163

Post by smt88 »

tomc1985 wrote: post #147

Fuck magic links. What a horrible login flow. Am I the only person taht doesn't have my email open in another tab?

> Am I the only person taht doesn't have my email open in another tab?

Magic links aren't targeted at the type of user you seem to be.

Most users of most products are: 1) on mobile devices, and 2) use a native email client.

They also don't have password managers, so magic links become a way to assume the security level of their personal email (which is what "forgot password" ends up doing anyway).

Re: Are Magic Links Outdated?

#164

Post by smt88 »

bradgessler wrote: post #30

I wrote a Rails plugin for magic links at https://github.com/rocketshipio/nopassword that doesn’t suffer from many of the problems I’m seeing in the comments. The big thing is I only use a 6 digit numerical code that people have to copy and paste or type into the browser which they’re authenticating. I looked at stuffing a token into a URL, but it’s not a good idea because the email client may try opening the link to…

You should take this nopassword repo down. It's a good example of why you shouldn't "roll your own" in InfoSec, and it would honestly make me skeptical of any of your other security work. It looks like you may not be using it for anything sensitive, but I'm worried that someone else might try to.

As an alternative, there are many hosted services (e.g. Auth0) that are well-regarded, and I'm sure there are some self-hosted options. There seems to be at least one way to do magic links on top of Keyclock[1].

1. https://github.com/p2-inc/keycloak-magic-link

Re: Are Magic Links Outdated?

#166

Post by [deleted] »

londons_explore wrote: post #92
pritambaral wrote: post #63

Earlier quoted context omitted.

> Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. The earliest Magic Links I remember using didn't have this problem, and this was before smartphones. The Link, back then at least, was only to authenticate that you can receive emails at a certain mailb…

You have to deal with 'email antivirus scanners' which click every link in a mail sent to every user in some sandboxed browser. If your user has one of those, then their account effectively has zero security since an attacker can attempt to log in, and the web security software will click the link, and the attacker (in the originating browser) is now logged in.

[deleted]

Re: Are Magic Links Outdated?

#167

Post by nibbleshifter »

capableweb wrote: post #5

Article fails to mention that "Magic Links" are not only possible via email, but any out-of-band method, so you could use Whatsapp, Telegram or IRC even. Obviously, the user is assumed to have a secure setup regarding whatever method you send the link via. Which the "Email Security" section kind of hints to as well, that it's important users have a secure email setup. What they fail to mention, is that this is import…

Great, now I'm going to spend the evening designing a login system that uses IRC private messages to deliver a magic link (or something, maybe ask for TOTP via the IRC chat?) for fun.

Re: Are Magic Links Outdated?

#168

Post by Kiro »

I use Magic Links because I don't trust the security of my hobby app and don't want to deal with storing credentials.

What I would like is a service like Firebase or OAuth but that I communicate with through my backend. So a user sends in username/password to my server and I relay that to a service which returns a token or something. I've had too many issues with the Firebase front-end JS that I no longer trust it to handle the whole flow.

Anyone know a service like that? Basically just an API that is specialized in auth/security that I can outsource the data to without having to store it myself.

Re: Are Magic Links Outdated?

#169

Post by acdha »

dijonman2 wrote: post #53
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

It’s just like anti-CSRF tokens, lots of edge cases and it’s hard to get right. I don’t have a pw manager on my mobile device nor do I want one, getting a 35+ char into an input field on my phone is a PITA.

> It’s just like anti-CSRF tokens, lots of edge cases and it’s hard to get right.

Do you have an example of the problems you've encountered? This is normally a turn-on-and-forget setting which is only slightly harder if you're using JavaScript to submit forms.

> I don’t have a pw manager on my mobile device nor do I want one, getting a 35+ char into an input field on my phone is a PITA.

What's your threat model for using long passwords but not using a password manager? I can understand why you might not want to store it on a cloud service even if it is encrypted but local storage is going to be more secure than entering it by hand if for no reason other than that it's harder to shoulder surf and harder to phish.

Re: Are Magic Links Outdated?

#170

Post by zonotope »

Kiro wrote: post #168

I use Magic Links because I don't trust the security of my hobby app and don't want to deal with storing credentials. What I would like is a service like Firebase or OAuth but that I communicate with through my backend. So a user sends in username/password to my server and I relay that to a service which returns a token or something. I've had too many issues with the Firebase front-end JS that I no longer trust it to…

I haven't used it in a while, but it sounds like Auth0 [https://auth0.com/] is what you're looking for.
Post reply on HN