Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

51–60 of 474 posts

Re: The "email is authentication" pattern

#51

Post by fragmede »

Rygian wrote: post #35
MBCook wrote: post #15

Earlier quoted context omitted.

Who copy and pastes from a password manager? Here’s my workflow, and I consider it superior to both of the above. Go to site, Safari offers to autofill, give TouchID/FaceID, get asked for a 2 factor code. Sent via SMS/email? Safari offers to autofill for me. TOTP style? Safari offers to autofill for me. Easy peasy. Passkeys are even easier as there is no second step and waiting for SMS/email.

> Who copy and pastes from a password manager? Me. I don't know of any other LAN-only method that works consistently across my various desktop and mobile devices.

okay, but you're using xclip/pbpaste/equivalent, yeah?

Re: The "email is authentication" pattern

#52

Post by gmuslera »

The second component of this, for people that doesn’t care to do good track of their passwords, is that their email passwords are usually memorable in the wrong way. So both your mail and all the dependent services are all held together with the same weak clip.

Double factor improved a bit this, or at least made it harder to break into this to some of the players, and simplified the process for some others.

Re: The "email is authentication" pattern

#53

Post by zajio1am »

paulgerhardt wrote: post #8

I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…

With greylisting, the flow B could take like 10 minutes.

Re: The "email is authentication" pattern

#54

Post by Ekaros »

gmuslera wrote: post #52

The second component of this, for people that doesn’t care to do good track of their passwords, is that their email passwords are usually memorable in the wrong way. So both your mail and all the dependent services are all held together with the same weak clip. Double factor improved a bit this, or at least made it harder to break into this to some of the players, and simplified the process for some others.

Email passwords is interesting one. As my feeling with something like gmail is that you insert it approximately once or twice per device... Which leads to weird dynamic that you have to recall it way too rarely for actually to remember it properly...

Re: The "email is authentication" pattern

#55

Post by ristos »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

It exists for US citizens at least: login.gov (https://developers.login.gov/oidc/getting-started/)

It has it's pros and cons, maybe more pros if you factor in that the biggest issue isn't authentication really, it's the fact that all of these private companies accrue everyone's sensitive info, which can be abused by any actor, private or public. If data were kept on the client side, and synced to other machines through P2P like WebRTC, then maybe this wouldn't be such a big deal.

Re: The "email is authentication" pattern

#56

Post by Saris »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

Some sites do that, like Netdata.

But it's slow compared to my PW manager just autofilling a user/PW combo, since I have to wait for the email and go click the link.

Re: The "email is authentication" pattern

#57

Post by DANmode »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

Humans understanding the basic concept of public/private keys,

wanting a Yubikey or similar,

and/or being able to use basic tools to make a key,

would also help.

But I'll take the government-led method as a Plan B, if it works.

Re: The "email is authentication" pattern

#58

Post by yencabulator »

jwr wrote: post #11

Some apps enforce this flow, e.g. there is no way to log in with a password. I hate this. Because of the developers of these apps assuming that E-mail guarantees instant delivery (it doesn't), I can't use greylisting, which reduced spam very significantly.

Your greylist setup really should learn good senders quicker; this shouldn't be an ongoing problem.

Re: The "email is authentication" pattern

#59

Post by robertlagrant »

The problem is just that despite all the advantages it would bring, people won't pay for auth as a service, where your identity is tied to accounts outside of an email address, and you (say) get a browser/phone notification to log in when you log in with MyAuthProvider and it's quick. They'd rather go through the email route, which is the same thing but slower and goes via Google.

Re: The "email is authentication" pattern

#60

Post by joncfoo »

ristos wrote: post #55
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

It exists for US citizens at least: login.gov ( https://developers.login.gov/oidc/getting-started/ ) It has it's pros and cons, maybe more pros if you factor in that the biggest issue isn't authentication really, it's the fact that all of these private companies accrue everyone's sensitive info, which can be abused by any actor, private or public. If data were kept on the client side, and synced to other machines thr…

Unfortunately login.gov is only available for use by companies doing business with the US government.
Post reply on HN