Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

201–210 of 230 posts

Re: Are Magic Links Outdated?

#201

Post by aaaaaaaaaaab »

smt88 wrote: post #164
bradgessler wrote: post #30

I wrote a Rails plugin for magic links at https://github.com/rocketshipio/nopassword that doesn’t suffer from many of the problems I’m seeing in the comments. The big thing is I only use a 6 digit numerical code that people have to copy and paste or type into the browser which they’re authenticating. I looked at stuffing a token into a URL, but it’s not a good idea because the email client may try opening the link to…

You should take this nopassword repo down. It's a good example of why you shouldn't "roll your own" in InfoSec, and it would honestly make me skeptical of any of your other security work. It looks like you may not be using it for anything sensitive, but I'm worried that someone else might try to. As an alternative, there are many hosted services (e.g. Auth0) that are well-regarded, and I'm sure there are some self-ho…

Yep. Promoting shit like this on a public forum is borderline malicious.

Re: Are Magic Links Outdated?

#202

Post by waihtis »

amacneil wrote: post #194
phphphphp wrote: post #181

Earlier quoted context omitted.

I used to think this but I don’t agree any more. A factor is a factor: your service password + your password manager password = 2 factors. Yes, if someone compromises your password manager then you’re in a bad position but that’s not what service-level multi-factor authentication protects against.

> that’s not what service-level multi-factor authentication protects against I don't understand your point. This is exactly what multi-factor authentication protects against if you don't store your MFA codes in your password manager.

A password may be compromised via other routes than just through a password manager hijack, which is probably far down the probability scale of all of the possible ways to do so

Re: Are Magic Links Outdated?

#203

Post by jarsbe »

kevincox wrote: post #12
jarsbe wrote: post #7

It depends. I used magic links for a system where the user would log in every 6-12 months. It didn't make sense to force them to make a password.

Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Register: 1. I click the password field. 2. I click "use autogenerated password" 3. Sign up. For login: 1. Click "login". The magic link experience is comparatively awful: 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site…

This is a perfect HN user response. You are a power user; "This is even worse if I am using a per-site email address" - no one does this. The majority of people are normal.

Re: Are Magic Links Outdated?

#204

Post by kevincox »

jarsbe wrote: post #203
kevincox wrote: post #12

Earlier quoted context omitted.

Why not? Most browsers are slowing pushing password managers on users and the experience is lovely. Register: 1. I click the password field. 2. I click "use autogenerated password" 3. Sign up. For login: 1. Click "login". The magic link experience is comparatively awful: 1. My email address never auto-fills so I need to click the field and select the completion suggestion. This is even worse if I am using a per-site…

This is a perfect HN user response. You are a power user; "This is even worse if I am using a per-site email address" - no one does this. The majority of people are normal.

Sure, but that barely changes the equation. Just a minor improvement over the power-user case.

Re: Are Magic Links Outdated?

#205

Post by [deleted] »

bsid wrote: post #178
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

At Clerk, ( https://clerk.dev , auth SaaS) we did a ton of work to get magic links to play nice with multiple devices, it's certainly a pain, and there's tradeoffs. The crux of it is, do you sign in the "originating" device (where the magic link was sent from), or the "consuming" device (where it was clicked). Because it's veryyy common for people to be on a website on their computer, then click the link on their pho…

[deleted]

Re: Are Magic Links Outdated?

#206

Post by zhfliz »

az_reth wrote: post #183
amacneil wrote: post #146

Earlier quoted context omitted.

If you're storing your "multi-factor" authentication codes in the same place (ahem, "factor") as your password, you're doing it wrong.

Except you're still protected whenever a website gets breached and all their passwords are dumped. Sure it's still a single point of failure but at least it's with a company dedicated to password security.

how?

standard TOTP MFA (which is what most password managers would offer in terms of MFA) uses a shared secret, which you would just dump from the same database you get the dumped passwords from.

unless you use asymmetric crypto e.g. in webauthn this doesn't benefit you at all.

Re: Are Magic Links Outdated?

#207

Post by mszary »

aaaaaaaaaaab wrote: post #200
mszary wrote: post #198

Earlier quoted context omitted.

> You didn’t explain how this gives you any protection akin to a physical chip on a debit card… In both cases you (an admin) control how many attempts you wish to accept before sacrificing the usability over security (temporarily disabling the card and forcing you to call the bank and disabling 6-digits OTP in favour of ie. 12-digits OTP). Your real-world analogy is, this time, too simplified :) Let me counter-argume…

So you actually agree with me. 1. I don’t have any problem with OTP-based magic links, if they’re implemented carefully. As you’ve just demonstrated, a 6-digit OTP with 3 retries allowed is not sufficient at scale. 2. I’ve also demonstrated that OP’s proposal to augment the 6-digit code with a “secret” token gives you no additional security. It can only protect against someone peeking over your shoulder to snatch you…

Seems like it :) but I would be more pragmatic and didn't bash the system for the reasons you brought up :)

ad 1 - IMO, it's still sufficient at scale with some basic infra. hardening

ad 2 - AFAIK the "secret" was never meant to protect from brute-force, but rather mitigate threats from actors controlling the email part

ad 3 - again, let's be more pragmatic - no one would use it if it required typing 13-letters OTP :) there are other ways to mitigate the potential attack you've described.

Best.

Re: Are Magic Links Outdated?

#208

Post by Macha »

joe_fishfish wrote: post #10
clement_b wrote: post #6

I hate them. Force me to go to my mailbox while I have a good password manager and just want to use that instead. I get the idea, but this should be an alternative, not a default. Also sends loads of single use emails that will remain for ever in users mailboxes.

If it's magic link or multi-factor authentication, I know which one I prefer. Try explaining to an MFA-loving service that your phone is out of action while it's being repaired.

Does your email not use MFA? So the choice not between magic links or MFA, it's between magic links and MFA or just MFA?

Re: Are Magic Links Outdated?

#209

Post by tryauuum »

anon23anon wrote: post #197
andybak wrote: post #82

Earlier quoted context omitted.

> MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. It might be howling into the void but the conclusion I reach from this is that "Mobile email clients are a nightmare". Generally speaking, embedded browsers in mobile apps are a terrible idea and break user expectations in multiple ways.

Back in the day on the web site the marketing team always insisted links open in a new windows b/c customers won't ever come back if you direct them away. Eventually browsers let users override that nonsense. The insistence by our marketing team on all these embedded browsers reminds me of the same mindset in 2020.

I also believe links should open in the same window, but I've met people who religiously believe otherwise and they are not a part of marketing team

Re: Are Magic Links Outdated?

#210

Post by capevace »

Magic links can be very helpful when needing to authorise people from an external system without API access, and they recently saved our asses from having to process over 10.000 refunds manually. Let me explain:

I work as a web dev for my local students union, and we recently had to develop a system to process refunds for basically every student there (9€ ticket related).

However, our university wanted nothing to do with that process, so we couldn’t use existing student login infrastructure to verify refund claims and limit them to one per student.

Luckily, each student gets a @stud.leuphana.de mail address. So all we had to do was send them a login link – if you weren’t a student or entered an invalid address you simply never received that, so you couldn’t apply.

The system worked great and with few issues, thanks to magic links!

Post reply on HN