Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are Magic Links Outdated?

zitadel.com

Post reply on HN
Print view View original

211–220 of 230 posts

Re: Are Magic Links Outdated?

#211

Post by jakub_g »

gfaster wrote: post #97
andybak wrote: post #82

Earlier quoted context omitted.

> MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. It might be howling into the void but the conclusion I reach from this is that "Mobile email clients are a nightmare". Generally speaking, embedded browsers in mobile apps are a terrible idea and break user expectations in multiple ways.

On the flip side, I find that opening links in isolated sessions very valuable, if not just because I don't want links sent by others to affect the Algorithm's perception of me. 80% of the time, I want to be a blank slate when interacting with in-app browsers.

On Android, if you have more than 1 browser, and no default browser app (settings / apps / default apps / browser app), clicking a link will ask you which browser you want to use. For random one-time-usage links, I use Firefox Focus for that purpose. When it's closed it wipes all history, cookies etc. automatically.

Meanwhile if the stupid app decides to hijack the link and use in-app browser, you can't do that. And IAB typically means you can't have app and browser in parallel and switch between them from app launcher, which would be sometimes useful. Slack does that, and it's annoying. But at least you can right click> copy URL and open it manually in preferred browser.

Re: Are Magic Links Outdated?

#212

Post by ghostly_s »

"Not device-dependent" is a false assumption. They are entirely dependent on you having convenient access to your email on the device. I have yet to to encounter one that was smart enough to authorize my session on the original device if I open the link on a different device (and there are probably good security arguments for not doing that).

Even in the ideal scenario where I have a proper mail client, the alternative they present is:

auto-filled password from my PW manager: 1 click

magic link: click to initiate the login session (1); click to focus my email client (2); [wait for email client to launch if not already open]; click on the email (3); click the magic link (4) click to close the superfluous second browser tab (5); click BACK to my mail client (6); click to delete the now-useless email (7); click BACK AGAIN to my browser (8).

Hate these things.

Re: Are Magic Links Outdated?

#213

Post by jakub_g »

Fnoord wrote: post #153
Joker_vD wrote: post #46

Earlier quoted context omitted.

It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links, I've turned it on, and yet the Gmail app still opens the links in the embedded Chrome browser — which has different cookies, different history that apparently is not synced with my other Chromes, and even looks sli-i-ightly different than "normal" Chrome, somehow. I've no idea why it is so difficult for a…

> It's actually pretty insane: there is a setting on Android to always use the main browser (Chrome) to open links That is quite insane indeed. And on top of that, Android keeps using Chrome as embedded browser. Even if you installed another one. MSHTML all over again.

Before that (Android [Note there are two things: 1) stupid apps putting a generic in-app browser inside the app - that's annoying; and 2) apps using a webview with a bridge between native app and a website, injecting some stuff and properly integrating the embedded website; something impossible to do by opening a website in regular browser]

Re: Are Magic Links Outdated?

#214

Post by rurp »

andybak wrote: post #82
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

> MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. It might be howling into the void but the conclusion I reach from this is that "Mobile email clients are a nightmare". Generally speaking, embedded browsers in mobile apps are a terrible idea and break user expectations in multiple ways.

Totally agree. Same apps have an option to disable this behavior, but it's a chore to track down and update everywhere. I would love it if Android had an OS level setting to disable these and send every request to the default browser. That might cost Google some data/money so sadly it'll probably never happen.

Re: Are Magic Links Outdated?

#215

Post by chadlavi »

robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

The stock mail app on iOS just opens links in safari

Re: Are Magic Links Outdated?

#216

Post by ignoramous »

amacneil wrote: post #192
robrobrobrob wrote: post #13

MagicLinks are a mobile nightmare. Mobile email clients use their own browser and cookie jar which consume the session cookie you're trying to put into the user's main browser. This results in users 'never staying signed in' and a lot of frustration. Sending a one-time code via email fixes this, and is in practice about as easy to use as a link on desktop. In our app (Loomio) we default to magic/codes, but let users…

They don't need to be - this is a limitation of how the site has implemented magic links. When implemented best, clicking the magic link in your email should simply confirm the authentication, and your _original_ browser window/tab should be signed in. That way, you can be signing in on a desktop browser, click the email link on your phone (or a different browser sandbox), and the desktop window will be signed in.

An adversary prompts the website to send you a magic link. You happen to click on it by chance. Guess who has access to your account?

As others have pointed out, either login when the user has both generated and clicked on the magic link from the same IP (browser, where possible), or use magic codes (as opposed to links).

Re: Are Magic Links Outdated?

#217

Post by emptysea »

Lorin wrote: post #140
kaichanvong wrote: post #35

Earlier quoted context omitted.

yeah on Discord this is almost magic.

I really like the QR code system they implemented, pretty handy

Yeah the QR code login is slick, TikTok also uses that.

The only caveat for implementing is that you essentially need to have a mobile app for your site, while SMS/email auth are more universal.

Re: Are Magic Links Outdated?

#218

Post by DocTomoe »

yababa_y wrote: post #144
DocTomoe wrote: post #136

Earlier quoted context omitted.

One of the first things I learned when I got onto the internet was that "consider (RFC822) emails to be postcards analogs, readable by anyone who stumbles over them, they are not like mail which hides its content in an envelope." That was in 1994. Shirts reading "I read your email" were popular with the IT guys up to until about ten years ago (and they are still being offered). Email is an inherently insecure, non-tr…

and yet, it is! for many webapps, and not long ago almosy all. pop someone’s email and suddenly you have access to gazillions of account recovery flows. despite email’s flaws, it’s the defacto decentralized user namespace and authorization fallback. in the case of modern email, t only the sender, receiver, and a chain of usually-authenticated intermediates actually can see the contents of mail. it’s not completely pl…

> if modern email transports don’t count, then isn’t it true that _any_ messaging system could be considered as postcards in that whoever stumbles across the message contents can read it?

You are mistaking transport layer "security" with information security. It's a common, yet potentially grave mistake.

Secure communication depends on encryption that is "good enough" so that unauthorised decryption takes too much resources or too much time to be practical, with the only encryption secrets being held by the sender and the receiver. We usually call that approach "End-to-end encryption", or E2EE. It is also something political entities try hard to ban, for obvious reasons, if you consider them mostly being suppressive-authoritarian surveillance state actors. (yes, I am aware of the '5 dollar hackwrench' xkcd comic [1]. If your state actor uses that tactic against you, you have a whole different problem).

True E2EE solutions for email exist, but - mostly because virtually no one wanted the extra hassle - they never got adopted widely.

In a perfect world, metadata would also be encrypted - or nonexistent at all (there are implementations for that, for example PGP-encrypted messages over bitstream over TOR (I know your 'bitstream address', but all messages get broadcast, e.g. via blockchain, to everyone, and you only pick out those that match your bitstream address. Because you have only your own private PGP key, you can't read the messages to other bitstream addresses, even though you have them).

[1] https://xkcd.com/538/

Re: Are Magic Links Outdated?

#219

Post by 8organicbits »

twistedpair wrote: post #160
8organicbits wrote: post #157

Earlier quoted context omitted.

Gmail app buries delete in a couple places in favor of archive. I routinely find I need to open a message to delete it, although the notification has an "archive" quick action button. Gmail made delete extra steps. I have virtually unlimited space for email, but they still show up in searches, and I'm certain I'll never want to look at them again.

Just hit "#". That wasn't buried very deep.

The comment is about the mobile app.

Re: Are Magic Links Outdated?

#220

Post by bradgessler »

DocTomoe wrote: post #136
yababa_y wrote: post #2

They don’t seem that outdated to me, given the evidence presented. email provider security is a real problem but is usually considered the root of trust for persons…

One of the first things I learned when I got onto the internet was that "consider (RFC822) emails to be postcards analogs, readable by anyone who stumbles over them, they are not like mail which hides its content in an envelope." That was in 1994. Shirts reading "I read your email" were popular with the IT guys up to until about ten years ago (and they are still being offered). Email is an inherently insecure, non-tr…

That’s why I keep the harder-to-guess secret in the browser where the code request was initiated. If somebody read the code from your “postcard” and tried to enter it, they’d see an error and have to start over.

Problem I have with most password reset schemes is they put the secret token in a URL, which is visible to all by the postcard analogy.

Post reply on HN