Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

101–110 of 474 posts

Re: The "email is authentication" pattern

#101

Post by easton »

dilyevsky wrote: post #98
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

ID.me kinda already does this. They integrate with IRS, SSA and bunch of local government stuff

Login.gov is the US Government’s homegrown solution, which also does it. It’s not one account one citizen though, which you’d probably want in a real government id system.

Re: The "email is authentication" pattern

#102

Post by motoboi »

miki123211 wrote: post #97

I'm surprised we don't have a standardized, cross-browser, simple, email-based authentication system. Basically something like this: 1. Website generates random string as challenge, sends to Browser, invokes API via JS on the client side. 2. Browser asks user to select the email to use, allows adding a new one. 3. Browser sends its auth token and challenge string to Browser Maker, Browser Maker verifies that the auth…

Well you kinda reinvented passkeys.

Re: The "email is authentication" pattern

#103

Post by boneitis »

gerdesj wrote: post #68
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Auth apps are crap - each one pretends to be unique and authoritative. TOTP secrets are a string, not just a QR code that can only be seen once and never again - the QR code merely encodes that string! That string can be used in multiple places to generate codes. KeepassXC can do it and that can be shared. I've seen loads of organisations and sites with an elderly mobile phone that has the TOTP auth app on it. Normal…

A little off-topic from the matter of adoption and usability by the greater masses, but I personally prefer these RFC 6238 TOTPs that I have the choice to take into my own hands, as opposed to internet-required, server-side based like my banking app and Okta.

I have a copy of all my TOTP generators (minus my dev Okta account) in a common authenticator app and an offline copy stored in an offline password manager, further replicated with an encrypted backup service.

I was able to create my offline copy in the first place thanks to a rooted phone to export what I already had up to that point out of the authenticator app.

Of course, the discussion starts to morph when we bring in the "un-phishable" software passkeys.

Re: The "email is authentication" pattern

#104

Post by scubbo »

weikju wrote: post #87
terribleperson wrote: post #82

Earlier quoted context omitted.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

Now you lock out the rest of the world until they can implement this and federate identities between countries.

That's not a problem. Many systems and services have launched geolocked to certain countries before later expanding (Google Voice, for one).

Re: The "email is authentication" pattern

#105

Post by eaglemfo »

I wish sites would acknowledge the need for a nerd mode that gets rid of all the stuff that annoys nerds and is essentially password or lockout, no resets. Enable reset methods or 2fa at your own whim.

For the rest you can do weird stuff that doesn't work on nerds.

Re: The "email is authentication" pattern

#106

Post by JonChesterfield »

ozr wrote: post #90
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

I haven't heard a compelling argument that anything needs to be fixed with email-based auth patterns. It is imperfect but not bad, and every proposed alternative seems to be worse. The article seems to lean into security and usability concerns. On the security front: the weak-point is still the human. If you hand over your credentials to someone nefarious, well.. you handed over your credentials to someone nefarious.…

One flaw is I'm pretty sure a lot gmail account is lost forever. Contacting Google to retrieve access would not go well. Related is that if you try to self host email your messages are unlikely to reach anyone.

Re: The "email is authentication" pattern

#107

Post by hnbad »

terribleperson wrote: post #82
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

Germany has PostIdent: you are issued a code, take it to the closest post office, hand them the code (originally this involved printouts) and your ID card and they scan your ID card and enter it into their system where the issuer of the code can then request that info to verify your identity.

This has largely been replaced by videochat for ID card verification where some underpaid person walks you through holding your ID card in front of your smartphone cameras to verify that it's real, not CG, not tampered with and matches your claimed identity.

The critical aspect here is that you don't have to hand your ID card (or a picture of it) to the company that wants to know your identity. The post office or the videochat provider serves as a trusted source of truth.

Re: The "email is authentication" pattern

#108

Post by quectophoton »

layer8 wrote: post #85
quectophoton wrote: post #50

Earlier quoted context omitted.

It certainly is an alternative we can at least think about. On one hand, the certs you'd use to login to websites wouldn't even need to include any personal info at all, just a valid signature from a CA that the website knows how to verify. And the certificate wouldn't need to be the same for every website, it could be one you generate for a specific website. On the other hand, a lot of thought would need to be put i…

Having only a single such address also means you can be blacklisted forever, in addition to being tracked across services.

What I had in mind was more like randomly generated addresses as needed, all of them linked to your (one) mailbox. Like Apple's "Hide My Email", but without needing a "main"/"canonical" email address because it would be unnecessary anyway (because you would be logging in to your mailbox with your own certificate).

But even if that single-address limitation were the case, the kind of places I would give it to already require knowing my national ID number anyway, so the two particular things you mention are already the status quo.

In other words, stuff that is already tied to having a verifiable citizenship.

Re: The "email is authentication" pattern

#109

Post by 9cb14c1ec0 »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

How about a bank-provided digital id that you get when opening an account by walking into a physical bank location and providing your photo ID? It would tick the "less prone to lock out" problem without placing even more power in government hands.

Re: The "email is authentication" pattern

#110

Post by ww520 »

terribleperson wrote: post #82
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

That takes mail spamming to the next level. (I'll show myself out...)
Post reply on HN