Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

61–70 of 474 posts

Re: The "email is authentication" pattern

#61

Post by byteflip »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I'm coding up a webapp with this exact login process - the issue I've found is on mobile phones - apps like gmail won't let you copy the link into a browser without a preview. The preview consumes the link. (next.js auth)

It's a bit annoying, since I don't want to login into the gmail in-app browser, I want to login on my regular browser.

Re: The "email is authentication" pattern

#63

Post by kevincox »

dishsoap wrote: post #49
paulgerhardt wrote: post #8

I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…

TOTP is not really something that would be sent to your email. The entire point of TOTP is that you can generate the auth code yourself, from the current time and a pre-shared secret.

I think the OP meant OTP. The general concept of one time passcodes, not TOTP as per RFC 6238

Re: The "email is authentication" pattern

#64

Post by aetherspawn »

byteflip wrote: post #61
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I'm coding up a webapp with this exact login process - the issue I've found is on mobile phones - apps like gmail won't let you copy the link into a browser without a preview. The preview consumes the link. (next.js auth) It's a bit annoying, since I don't want to login into the gmail in-app browser, I want to login on my regular browser.

Don’t forget some people have antivirus scanners that will load up every link when the email is opened, so you can’t have the link expire after 1 visit.

This is I think why unsubscribe links now have a single button saying “Unsubscribe” or similar when you press them. Likewise anything interesting should require a 2nd user action after loading the page.

Re: The "email is authentication" pattern

#65

Post by capitainenemo »

joncfoo wrote: post #60
ristos wrote: post #55

Earlier quoted context omitted.

It exists for US citizens at least: login.gov ( https://developers.login.gov/oidc/getting-started/ ) It has it's pros and cons, maybe more pros if you factor in that the biggest issue isn't authentication really, it's the fact that all of these private companies accrue everyone's sensitive info, which can be abused by any actor, private or public. If data were kept on the client side, and synced to other machines thr…

Unfortunately login.gov is only available for use by companies doing business with the US government.

Also login.gov isn't a government issued digital ID. It's just a centralised authentication platform for government use, much like using google or apple for authentication.

It supports the usual options for multifactor (TOTP, text, yubikey/other hardware auth/PIV cards) but for most users it probably ends up being SMS. At best TOTP.

Re: The "email is authentication" pattern

#66

Post by stavros »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I do this for many of my web apps, it's confusing to users ("why do I already have an account here? I never signed up!"), expensive (email sending isn't free) and slow (sometimes the emails go to spam, sometimes they get greylisted and people can't log in for hours, sometimes it takes a minute to arrive and that's way too long to wait), etc. I don't know if I'd recommend it.

Re: The "email is authentication" pattern

#67

Post by righthand »

byteflip wrote: post #61
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I'm coding up a webapp with this exact login process - the issue I've found is on mobile phones - apps like gmail won't let you copy the link into a browser without a preview. The preview consumes the link. (next.js auth) It's a bit annoying, since I don't want to login into the gmail in-app browser, I want to login on my regular browser.

A work around could be: login link token is good for 24hours unused, or 5mins after the first use. That way you don’t leave the user in a loop or risk them not clicking the link within a short amount of time. The token still expires after a reasonable duration too.

Re: The "email is authentication" pattern

#68

Post by gerdesj »

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Auth apps are crap - each one pretends to be unique and authoritative.

TOTP secrets are a string, not just a QR code that can only be seen once and never again - the QR code merely encodes that string! That string can be used in multiple places to generate codes. KeepassXC can do it and that can be shared. I've seen loads of organisations and sites with an elderly mobile phone that has the TOTP auth app on it. Normally MS Authenticator.

To add insult to injury, MS Auth can only have one account per email address (id@realm/whatever you want to call it).

PrivacyIdea can do email based TOTP with a PIN. That works well but does involve a two stage login with an email delivery in the middle.

I totally agree with you: the only useful delivery mechanism available is email. PGP was a nice idea and authenticator apps need to have their owner's heads bashed together to get proper interoperability sorted out. Trying to silo people in your "cloud" without interoperability with others is so sad and needy. If you don't have absolute confidence in your offering then you are shit!

Re: The "email is authentication" pattern

#69

Post by tqi »

> When I ask people why they do this, they either don’t have an answer, or respond with “huh, I never thought about why”. And that’s interesting to me.

I do this because I don't care enough about the particular account or use it frequently enough to manage put more effort into it.

Re: The "email is authentication" pattern

#70

Post by Fabricio20 »

MBCook wrote: post #15
paulgerhardt wrote: post #8

I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…

Who copy and pastes from a password manager? Here’s my workflow, and I consider it superior to both of the above. Go to site, Safari offers to autofill, give TouchID/FaceID, get asked for a 2 factor code. Sent via SMS/email? Safari offers to autofill for me. TOTP style? Safari offers to autofill for me. Easy peasy. Passkeys are even easier as there is no second step and waiting for SMS/email.

> Who copy and pastes from a password manager?

I do! And way more than I would like, because for some reason it's "modern" to have a login flow that first requests your email, and then you have to click next for it to request your password...

Not even gonna go into detail about all the other cases like websites that have such bad field identification that the password manager has no clue where to put the username/email or 99% of sites that don't have autocomplete="one-time-code" on the 2FA field so now you have to copy paste the 2fa.

Plus all the android buggyness where the auto-complete from the password manager just doesn't show up at all so you have to switch apps and copy/paste the credentials manually... when it works (and doesn't clear the fields as you swap between apps... I swear built-in chrome windows is a mistake).

Post reply on HN