The "email is authentication" pattern • Hacker News Board

Re: The "email is authentication" pattern

#21

Post by dogcomplex » Sat, Sep 07, 2024, 7:56 PM UTC

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email.

Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do the same pattern with a message to your phone "click to authenticate login: www.someurl.com?p=134234535" and you've got 2FA without any dumb "enter this code".

Re: The "email is authentication" pattern

#22

Post by hansvm » Sat, Sep 07, 2024, 7:57 PM UTC

ydnaclementine wrote: post #17

voiper1 wrote: post #12

Earlier quoted context omitted.

I use a password manager. I don't like flipping back to my email, I already have a secure password.

The most secure password is no password

Totally agreed. The account though, that's another question. Would you mind sharing the username of your favorite passwordless account?

Re: The "email is authentication" pattern

#23

Post by hgomersall » Sat, Sep 07, 2024, 7:57 PM UTC

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

It's an interesting design problem to have panel of peers attest an individual's identity. It could be made fairly seamless if there was a common system in which a suitably distributed authentication secret could be recombined under instruction from the relevant party. Can it be made to work for normal humans? I daresay we have the ingenuity to design something...

Re: The "email is authentication" pattern

#24

Post by fmeyer » Sat, Sep 07, 2024, 7:59 PM UTC

Identity is tricky. Proving who you are depends on a certain level of trust. Whether it's through email, devices, phones, or, in more advanced settings, some sort of digital certificate; you won't have much options.

Unless you're in Germany using a service provided by the Vogons, you might end up getting a letter containing an activation PIN via snail mail or worst having to visit the post office to show your passport.

Re: The "email is authentication" pattern

#25

Post by crooked-v » Sat, Sep 07, 2024, 8:01 PM UTC

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Unfortunately, "they just don't get access anymore" is the usual pattern with major email providers like Google, as many people who have had a phone lost or stolen and then been locked out of their accounts forever can attest to.

Re: The "email is authentication" pattern

#26

Post by unilynx » Sat, Sep 07, 2024, 8:01 PM UTC

hgomersall wrote: post #23

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

It's an interesting design problem to have panel of peers attest an individual's identity. It could be made fairly seamless if there was a common system in which a suitably distributed authentication secret could be recombined under instruction from the relevant party. Can it be made to work for normal humans? I daresay we have the ingenuity to design something...

except that those instructions will be handed out by phishers

Re: The "email is authentication" pattern

#27

Post by paulgerhardt » Sat, Sep 07, 2024, 8:01 PM UTC

MBCook wrote: post #15

paulgerhardt wrote: post #8

I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…

Who copy and pastes from a password manager? Here’s my workflow, and I consider it superior to both of the above. Go to site, Safari offers to autofill, give TouchID/FaceID, get asked for a 2 factor code. Sent via SMS/email? Safari offers to autofill for me. TOTP style? Safari offers to autofill for me. Easy peasy. Passkeys are even easier as there is no second step and waiting for SMS/email.

Yes, that is a nice solution.

I suppose the reason is because the Bitwarden option is cross platform and I don't want to sync two password managers.

However when using Bitwarden the recent guidance is to turn off autofill[1] but even with it enabled it sometimes breaks hence my “seldom” caveat.

I am heavily biased to prefer passkeys but as with magiclinks before them saw the rollout was badly botched. Specifically with regards to supporting multiple keys and revocation[2][3]. The standard supports correct implementation but don't require it; meaning most current rollouts are half baked and will remain that way.

[1] https://flashpoint.io/blog/bitwarden-password-pilfering/

[2] ie: https://www.reddit.com/r/yubikey/comments/14h0d7y/single_key...

[3] https://news.ycombinator.com/item?id=40165998

Re: The "email is authentication" pattern

#28

Post by jlund-molfese » Sat, Sep 07, 2024, 8:02 PM UTC

hgomersall wrote: post #23

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

It's an interesting design problem to have panel of peers attest an individual's identity. It could be made fairly seamless if there was a common system in which a suitably distributed authentication secret could be recombined under instruction from the relevant party. Can it be made to work for normal humans? I daresay we have the ingenuity to design something...

Apple’s Recovery Contacts are a similar idea. The main difference is that just one can help you recover your account, but it doesn’t seem too hard from a UX perspective to make 3/5 recovery contacts required to unlock an account.

https://support.apple.com/en-us/102641

Re: The "email is authentication" pattern

#29

Post by candiddevmike » Sat, Sep 07, 2024, 8:02 PM UTC

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

Re: The "email is authentication" pattern

#30

Post by nfw2 » Sat, Sep 07, 2024, 8:02 PM UTC

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Can you expand what you mean when you say the security of phone numbers is leagues below email? If someone can gain access to someone's phone, it seems like they would gain access to their email as well.