Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

71–80 of 474 posts

Re: The "email is authentication" pattern

#71

Post by aucisson_masque »

tqi wrote: post #69

> When I ask people why they do this, they either don’t have an answer, or respond with “huh, I never thought about why”. And that’s interesting to me. I do this because I don't care enough about the particular account or use it frequently enough to manage put more effort into it.

Exactly, that should be obvious but it's just that they don't care enough.

My mother used to do that, until I teach her about bitwarden and it has completely changed her thought process. It's just that having to remember every password is impossible and they don't know about password manager.

Re: The "email is authentication" pattern

#72

Post by aucisson_masque »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

> Government provided digital IDs

Oh man, that sounds like a terrible idea privacy wise. Every website would make use of it to track it's user.

Re: The "email is authentication" pattern

#73

Post by echoangle »

stavros wrote: post #66
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I do this for many of my web apps, it's confusing to users ("why do I already have an account here? I never signed up!"), expensive (email sending isn't free) and slow (sometimes the emails go to spam, sometimes they get greylisted and people can't log in for hours, sometimes it takes a minute to arrive and that's way too long to wait), etc. I don't know if I'd recommend it.

Can you elaborate on „email sending isn’t free“? What are you using to host the webapp? Can’t you just set up your own mail server and send whatever you want?

Re: The "email is authentication" pattern

#74

Post by j45 »

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Passwords are consent, clicking on a link in an email account that might be open... not always.

Re: The "email is authentication" pattern

#75

Post by kfrzcode »

hgomersall wrote: post #23
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

It's an interesting design problem to have panel of peers attest an individual's identity. It could be made fairly seamless if there was a common system in which a suitably distributed authentication secret could be recombined under instruction from the relevant party. Can it be made to work for normal humans? I daresay we have the ingenuity to design something...

The Decentralized Recovery (DeRec) Alliance has recently launched to solve this very problem. Dr. Leemon Baird gave a talk last year on how this works at a higher level [0]. The alliance is comprised of members from the Algorand, Hedera, Ripple crypto communities but the application of proper DeRec would be certainly applicable anywhere you have any type of secret; in fact I believe you can be a DeRec 'helper' right now. There's a robust primer on the protocol published as well [1], here's a pull-quote:

> Decentralized recovery is a method of safeguarding a user's secret by distributing shares of that secret among multiple helpers, who store their individual share on their local device in order to help the user recover that secret in future. The shares are constructed under a threshold secret-sharing scheme (e.g. Shamir's secret sharing scheme), with a chosen threshold (defaults to half) -- at least three helpers must be present in order to use the protocol. Should the user lose access to their device, they can recover their secret data by retrieving the previously-distributed shares from at least half of their helpers. For successful recovery, the user only needs to recall the identities of half of their helpers and authenticate with them in-person.

[0]: https://www.youtube.com/watch?v=AcF4abPoveM

[1]: https://github.com/derecalliance/protocol/blob/main/protocol...

Re: The "email is authentication" pattern

#76

Post by j45 »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

I'm not so sure how many ppl would leave a key to their house, or a pin to their bank account with the government. Or a bank.

Identity is relatively solved, there are just lots of sacrifices made in security in the name of convenience.

Fingerprints as consent to login, Facial recognition as consent to login... seems more like a username, than a password, or a username+password.

Re: The "email is authentication" pattern

#77

Post by MrGilbert »

Interestingly enough, that is the login flow Figma is using with my account. I provide my email address, and get an email that contains a linkt to log me in.

I remember having seen this idea at other places before. I don't really like it, because for me, using a password manager makes everything already quite convenient.

Re: The "email is authentication" pattern

#78

Post by drekipus »

kwhitefoot wrote: post #33
paulgerhardt wrote: post #8

I’ll be hyperbolic and say the login flow is identical. A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity. Or B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters. In many instances, login flow B is actually quicker and seldom slower. Clicking the…

Doesn't your browser remember your passwords?

my wife chooses not to let chrome remember her passwords because she thinks it's lazy and insecure: everyone uses chrome, how will chrome know not to give her password to someone else?

Re: The "email is authentication" pattern

#79

Post by j45 »

nfw2 wrote: post #30
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Can you expand what you mean when you say the security of phone numbers is leagues below email? If someone can gain access to someone's phone, it seems like they would gain access to their email as well.

SMS codes for anything are not secure. Convenience over security, maybe.

SMS are as secure as a letter compared to a postcard.

Re: The "email is authentication" pattern

#80

Post by [deleted] »

JumpCrisscross wrote: post #40
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

> Government provided digital IDs would solve a lot of this A lot of what? It seems like the worst of all worlds, given that ID would not only unlock some highly sensitive things, but also be difficult to change and tremendously revealing.

[deleted]
Post reply on HN