Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

171–180 of 230 posts

Re: Are Magic Links Outdated?

#171

Post by dont__panic »

snovv_crash wrote: post #125
Joker_vD wrote: post #46

Earlier quoted context omitted.

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

Uninstall chrome and use Firefox, and it works for me with full cookie sharing. There is even an "open in Firefox" in the hamburger drop-down which transfers the page to the browser app without reloading.

Can you uninstall chrome from most Android phones? I think I've tried in the past but failed.

Re: Are Magic Links Outdated?

#172

Post by acdha »

joe_fishfish wrote: post #10
clement_b wrote: post #6

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

If it's magic link or multi-factor authentication, I know which one I prefer. Try explaining to an MFA-loving service that your phone is out of action while it's being repaired.

Here's what that's like with WebAuthn:

1. Use my Yubikey with a different phone via NFC or a different computer using USB 2. Login using my other iPhone or Mac because the WebAuthn passkey is synced via iCloud (this is in the progress of coming to Chrome & Windows)

The nice thing is that all of those are more convenient than using email in addition to being more secure.

Re: Are Magic Links Outdated?

#173

Post by tomc1985 »

smt88 wrote: post #163
tomc1985 wrote: post #147

Fuck magic links. What a horrible login flow. Am I the only person taht doesn't have my email open in another tab?

> Am I the only person taht doesn't have my email open in another tab? Magic links aren't targeted at the type of user you seem to be. Most users of most products are: 1) on mobile devices, and 2) use a native email client. They also don't have password managers, so magic links become a way to assume the security level of their personal email (which is what "forgot password" ends up doing anyway).

It doesn't matter. Crap like this makes the web worse. We cannot keep catering to people who refuse to learn better practices.

If the industry got itself together enough to start teaching people good internet hygiene we'd all be much better off. But instead we strip away OK security for horrible security, and inconvenience nearly everyone in the process.

Re: Are Magic Links Outdated?

#174

Post by BoorishBears »

Kiro wrote: post #168

I use Magic Links because I don't trust the security of my hobby app and don't want to deal with storing credentials. What I would like is a service like Firebase or OAuth but that I communicate with through my backend. So a user sends in username/password to my server and I relay that to a service which returns a token or something. I've had too many issues with the Firebase front-end JS that I no longer trust it to…

Auth0 via Universal Login essentially fixes the crappy frontend JS problem, JS-free login page driven by an HTML template that you redirect to and get back a code

There's also "dbconnections" endpoints where you can post raw sign-up data though if you're looking strictly for the backend piece

Re: Are Magic Links Outdated?

#175

Post by mszary »

aaaaaaaaaaab wrote: post #116
joshstrange wrote: post #106

Earlier quoted context omitted.

I'm pretty sure you are missing how they implementing this. It sounds like at time of the request to send the code the browser either generates and sends to the server (or gets from the server) a longer/more-complicated secret. Both that secret (which is probably account-specific, the one you requested login to) and the 6 digit code are required. You can't just guess the code, the code has to be combined with another…

No, actually I'm pretty sure you are missing why their system is insecure. But sure, let me explain it: Step 1: acquire a list of 230 000 usernames/emails. Step 2: for each username/email, launch a browser and request a login code. The login code is sent to the users' email address, and the super-ultra-secret token is stored in the browser. Step 3: for each username/email, do 3 random guesses from their respective br…

You're over complicating this. In fact it might provide a similar kind of protection the physical chip provides for debit cards. Let me explain:

1. Someone (anyone) initiates the login flow

2. The user record in a DB gets enriched with

- the 6-digit OTP (sent via email)

- the "secret" (shared with the initiating browser)

- the current session failed attempts counter (default: 0, max: 3)

- the total failed attempts counter since last successful login (default: 0, max: 20)

Let's assume that you've initiated the session (hence own the "secret"), but have no access to the OTP - you will always have 3 attempts to guess the OTP before the session gets reset (a new "secret" + new OTP). So after the 3rd unsuccessful attempt you start from scratch. And at that point other means of protection might come into play based on the second counter (throttling the auth. requests on the WAF/fronting server, blacklisting IP addresses, etc.)

The number of accounts you're targeting does not matter - in fact it may help other systems mentioned catch your malicious attempts sooner.

Re: Are Magic Links Outdated?

#176

Post by JamesSwift »

Joker_vD wrote: post #46
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

> I've no idea why it is so difficult for apps to open links in the user-selected browser. Isn't it just "xdg-open https://example.com/"?

No, theres implementation differences across API levels and the "shared cookie jar" implementation is newer and had some quirks. Its been a couple years since I was deep in this so it might have changed, but that was my experience back then.

Re: Are Magic Links Outdated?

#177

Post by IggleSniggle »

couchand wrote: post #149
IggleSniggle wrote: post #90

Earlier quoted context omitted.

As a user the problem I run into with some frequency is passwordless login where the waiting session loses its “waiting” status because I switched the active application in iOS from my browser to my email and back again. When I get back, the page for whatever reason (refresh after being backgrounded?) requires a new auth attempt. A wrinkle in this complaint is that in most scenarios I don’t especially want a browser…

A simple workaround for the implementation is to redirect you to a URL with the code hashed as a query parameter.

Yes, I was thinking about that, as something like a TOTP. But that needs to be done via DNS-over-HTTPS or DNS-over-TLS or else the code can be sniffed by a MITM since the URL is sent in the clear, at which point you’re back to the problem of persistent TLS anyway.

Edit: In fact, nevermind. My thinking on that was flawed. I think you’re right, that should be fine, as long as the DNS is encrypted.

Re: Are Magic Links Outdated?

#178

Post by bsid »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

At Clerk, (https://clerk.dev, auth SaaS) we did a ton of work to get magic links to play nice with multiple devices, it's certainly a pain, and there's tradeoffs.

The crux of it is, do you sign in the "originating" device (where the magic link was sent from), or the "consuming" device (where it was clicked).

Because it's veryyy common for people to be on a website on their computer, then click the link on their phone, but still want to be logged into their computer. We opted for the "originating" device. But this has security concerns.

(you also need to worry about multiple tabs on the same browser, but cookies make this easy to deal with)

But, what if an attacker just sends a link to loads of email addresses, and one of the receivers clicks on it by accident? Their account now has been taken-over.

So, this needs to be combined with the notion of "trusted devices", and of course, not breaking what the user expects. All in all, a TON of work to get some marginal gains in some sectors, mainly B2C. IMO, B2B should always have passwords as an option. 1Pass is too widely used to ignore.

Re: Are Magic Links Outdated?

#179

Post by IggleSniggle »

londons_explore wrote: post #93
IggleSniggle wrote: post #90

Earlier quoted context omitted.

As a user the problem I run into with some frequency is passwordless login where the waiting session loses its “waiting” status because I switched the active application in iOS from my browser to my email and back again. When I get back, the page for whatever reason (refresh after being backgrounded?) requires a new auth attempt. A wrinkle in this complaint is that in most scenarios I don’t especially want a browser…

> (refresh after being backgrounded?) This is a problem on low memory devices - the page gets forced to refresh because the system ran out of RAM. The iPhone 13 only has 4GB of RAM, and with many apps requiring 2+GB, it is frequent a web page can't stay loaded in the background. Most android devices have 8GB plus RAM, so shouldn't hit that issue, although it still happens on very low end devices.

They can take my iPhone 7 and its 2GB of RAM over its dead body.

Re: Are Magic Links Outdated?

#180

Post by jsmith99 »

snovv_crash wrote: post #125
Joker_vD wrote: post #46

Earlier quoted context omitted.

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

Uninstall chrome and use Firefox, and it works for me with full cookie sharing. There is even an "open in Firefox" in the hamburger drop-down which transfers the page to the browser app without reloading.

I get that with Kiwi browser's custom tab as well. Kiwi is a fork of chrome for Android with extension support. Is it not in stock chrome?
Post reply on HN