Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

181–190 of 230 posts

Re: Are Magic Links Outdated?

#181

Post by phphphphp »

amacneil wrote: post #146
dymk wrote: post #133

Earlier quoted context omitted.

1password and Lastpass both manage MFA codes and work cross-device. If your phone is your only way to get into MFA protected accounts, you're doing it wrong. What happens if you can't repair your phone?

If you're storing your "multi-factor" authentication codes in the same place (ahem, "factor") as your password, you're doing it wrong.

I used to think this but I don’t agree any more. A factor is a factor: your service password + your password manager password = 2 factors. Yes, if someone compromises your password manager then you’re in a bad position but that’s not what service-level multi-factor authentication protects against.

Re: Are Magic Links Outdated?

#182

Post by jsmith99 »

Fnoord wrote: post #153
Joker_vD wrote: post #46

Earlier quoted context omitted.

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

> It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links That is quite insane indeed. And on top of that, Android keeps using Chrome as embedded browser. Even if you installed another one. MSHTML all over again.

Many browsers such as Firefox and Kiwi let you enable them for 'custom tabs' which is the term for popup browser windows that you may be thinking of as embedded browsers. I think the setting is usually within the app's settings rather than the general android settings.

Re: Are Magic Links Outdated?

#183

Post by az_reth »

amacneil wrote: post #146
dymk wrote: post #133

Earlier quoted context omitted.

1password and Lastpass both manage MFA codes and work cross-device. If your phone is your only way to get into MFA protected accounts, you're doing it wrong. What happens if you can't repair your phone?

If you're storing your "multi-factor" authentication codes in the same place (ahem, "factor") as your password, you're doing it wrong.

Except you're still protected whenever a website gets breached and all their passwords are dumped. Sure it's still a single point of failure but at least it's with a company dedicated to password security.

Re: Are Magic Links Outdated?

#184

Post by aaaaaaaaaaab »

mszary wrote: post #175
aaaaaaaaaaab wrote: post #116

Earlier quoted context omitted.

No, actually I'm pretty sure you are missing why their system is insecure. But sure, let me explain it: Step 1: acquire a list of 230 000 usernames/emails. Step 2: for each username/email, launch a browser and request a login code. The login code is sent to the users' email address, and the super-ultra-secret token is stored in the browser. Step 3: for each username/email, do 3 random guesses from their respective br…

You're over complicating this. In fact it might provide a similar kind of protection the physical chip provides for debit cards. Let me explain: 1. Someone (anyone) initiates the login flow 2. The user record in a DB gets enriched with - the 6-digit OTP (sent via email) - the "secret" (shared with the initiating browser) - the current session failed attempts counter (default: 0, max: 3) - the total failed attempts co…

>In fact it might provide a similar kind of protection the physical chip provides for debit cards. Let me explain:

You didn’t explain how this gives you any protection akin to a physical chip on a debit card…

Let me illuminate the problem with a real-world analogy: this system is like me walking into a bank with a list of account names, and the bank issuing me debit cards for those accounts with random PIN codes, no questions asked. I’d have 3 attempts to guess the PIN, then the ATM swallows the card. Same as in OPs login system!

Still, don’t you think banks would be silly to do this?

>So after the 3rd unsuccessful attempt you start from scratch.

You don’t start from scratch. You do 3 attempts per user, period.

>The number of accounts you're targeting does not matter

It does matter. The entropy of their six-digit OTP is small enough that pwning at least one account from a pool of users is feasible. As I’ve shown above, the number of users necessary for pwning at least one account with 50% probability is log(0.5)/log((1 - 10^-[digits])^[attempts per user]). In our case digits = 6, and attempts per user = 3, which gives us ~231000 users. Which isn’t too many for a website.

Re: Are Magic Links Outdated?

#186

Post by inopinatus »

bsid wrote: post #178
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

At Clerk, ( https://clerk.dev , auth SaaS) we did a ton of work to get magic links to play nice with multiple devices, it's certainly a pain, and there's tradeoffs. The crux of it is, do you sign in the "originating" device (where the magic link was sent from), or the "consuming" device (where it was clicked). Because it's veryyy common for people to be on a website on their computer, then click the link on their pho…

Never do this. Automated email scanners may fetch the URL. For example, Hotmail’s mail delivery process is notorious for triggering magic links.

Re: Are Magic Links Outdated?

#187

Post by acdha »

amacneil wrote: post #146
dymk wrote: post #133

Earlier quoted context omitted.

1password and Lastpass both manage MFA codes and work cross-device. If your phone is your only way to get into MFA protected accounts, you're doing it wrong. What happens if you can't repair your phone?

If you're storing your "multi-factor" authentication codes in the same place (ahem, "factor") as your password, you're doing it wrong.

This is why you need to start with a threat model. For example, if your concern is password reuse or weak passwords simply using a password manager to have unique per-site passwords solves that problem for almost anyone.

If your concern is phishing, storing the code on the device (especially on a modern phone) is really moot since all forms of one-time codes are vulnerable — you should be working on how to switch to FIDO2/WebAuthn.

If your concern is a temporary exploit of the user's browser, using an out-of-process password manager is likely to prevent exfiltration of the entire password list but in practice this is already probably a disaster scenario unless you're using sites which require a strong FIDO2 challenge for sensitive operations since the attacker already has your cookies for everything you use regularly.

Re: Are Magic Links Outdated?

#188

Post by cercatrova »

dont__panic wrote: post #171
snovv_crash wrote: post #125

Earlier quoted context omitted.

Uninstall chrome and use Firefox, and it works for me with full cookie sharing. There is even an "open in Firefox" in the hamburger drop-down which transfers the page to the browser app without reloading.

Can you uninstall chrome from most Android phones? I think I've tried in the past but failed.

Go to Settings, apps, search for Chrome and click the disable button.

Re: Are Magic Links Outdated?

#189

Post by code_duck »

tshaddox wrote: post #154
Joker_vD wrote: post #46

Earlier quoted context omitted.

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

That’s odd. I have used the Gmail app on iOS for many years, and as far as I can remember it has always just opened links directly in Safari.

I get a choice of Chrome, Google app (which isn’t even installed) and Safari. I mainly use Firefox, though, and that isn’t an option.

Re: Are Magic Links Outdated?

#190

Post by joshstrange »

DocTomoe wrote: post #134
joshstrange wrote: post #123

Earlier quoted context omitted.

> > Do you not have to enter email on register? > Yes, I have omitted this from both workflows. You specifically complained about having to enter your email on the magic link flow: > 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site email address. > > is a magic link really so difficult to use twice a year? > No, but it…

> but there is absolutely a cost to the developer and I'm not talking about the cost of storing a hashed/salted password in the DB itself. There is a cost to build and maintain a password-based system. Seriously ... if today's developers are unable or unwilling to learn about basic hashing/salting and database storage/value comparison, and consider such concepts 'costly' ... we may have passed the zenith of technolog…

It's amazing how you, knowing nothing about my stack/use-case can speak with such authority. Going as far as to assume that we must be in a "'downfall of the Roman Empire' phase" because I see value in magic links and because I don't want to implement password support, again, in a product you know nothing about.

I have a very good reason for picking magic links, also the codebase for my project does not ruse a framework (there exist no good ones in the space I'm in) but instead of being curious you decided to be condescending. Cool.

Post reply on HN