Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

121–130 of 474 posts

Re: The "email is authentication" pattern

#121

Post by cyberax »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

Clear in the US can do that: https://www.clearme.com/for-your-business

It's not exactly a government service, but Clear is trusted by the government enough to allow their customers to bypass the airport screenings.

Re: The "email is authentication" pattern

#122

Post by simonw »

kfrzcode wrote: post #75
hgomersall wrote: post #23

Earlier quoted context omitted.

It's an interesting design problem to have panel of peers attest an individual's identity. It could be made fairly seamless if there was a common system in which a suitably distributed authentication secret could be recombined under instruction from the relevant party. Can it be made to work for normal humans? I daresay we have the ingenuity to design something...

The Decentralized Recovery (DeRec) Alliance has recently launched to solve this very problem. Dr. Leemon Baird gave a talk last year on how this works at a higher level [0]. The alliance is comprised of members from the Algorand, Hedera, Ripple crypto communities but the application of proper DeRec would be certainly applicable anywhere you have any type of secret; in fact I believe you can be a DeRec 'helper' right…

Some day someone is going to produce a fantastic heist movie about breaking this kind of scheme - five different characters, each of which need to be scammed in different ways to obtain their piece of a shared secret.

Sadly it's quite possible this will be a dramatized version of a real-world event. We've already seen quite a few messed up crimes to steal keys to steal crypto. Secret sharing just means you need to kidnap a few extra people.

Re: The "email is authentication" pattern

#123

Post by lotsofpulp »

cyberax wrote: post #121
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

Clear in the US can do that: https://www.clearme.com/for-your-business It's not exactly a government service, but Clear is trusted by the government enough to allow their customers to bypass the airport screenings.

Screw Clear and screw the US government for allowing more privatization of public infrastructure.

Re: The "email is authentication" pattern

#124

Post by elros »

hnbad wrote: post #107
terribleperson wrote: post #82

Earlier quoted context omitted.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

Germany has PostIdent: you are issued a code, take it to the closest post office, hand them the code (originally this involved printouts) and your ID card and they scan your ID card and enter it into their system where the issuer of the code can then request that info to verify your identity. This has largely been replaced by videochat for ID card verification where some underpaid person walks you through holding you…

Initially when I moved to Germany I thought it was a bit of a hassle to have to go to the post office for PostIdent; now I actually miss the elegance and privacy of that system in other countries.

Re: The "email is authentication" pattern

#125

Post by quectophoton »

terribleperson wrote: post #82
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

Yes!

Stuff like national ID, banks, ISP, job search websites, doctor appointments, etc, require[1] having an email address, and it feels wrong using gmail and similar providers for these use cases that are already tied to you having a physical presence in that location anyway.

Could be provided by any local company, really, but postal services are not going to disappear anytime soon and they already have a second way of getting in contact with you if there's any issue (registered mail[2]).

Debit cards are already delivered through postal mail anyway, and there's not many things that are more sensitive than that.

[1]: Well, maybe doctor appointments don't require and only strongly encourage, but that doesn't affect the point too much.

[2]: https://en.wikipedia.org/wiki/Registered_mail

Re: The "email is authentication" pattern

#126

Post by dugite-code »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

> Have it expire within 10 mins if not used

Please never do this short amount of time. Email isn't reliable time-wise for delivery. You have systems like Postgrey (one of the basic spam protections for email servers) and deliberately pretends the email server is offline for emails from new servers until they server retries a set number of times.

Not to mention if your email ends up in a corporate quarantine until you can request it released.

Re: The "email is authentication" pattern

#127

Post by bscphil »

jerf wrote: post #113
gerdesj wrote: post #68

Earlier quoted context omitted.

Auth apps are crap - each one pretends to be unique and authoritative. TOTP secrets are a string, not just a QR code that can only be seen once and never again - the QR code merely encodes that string! That string can be used in multiple places to generate codes. KeepassXC can do it and that can be shared. I've seen loads of organisations and sites with an elderly mobile phone that has the TOTP auth app on it. Normal…

I'm increasingly coming around to the idea that in reality, there's only one factor, at least as far as the Internet is concerned: Something you know. There's different ways of knowing it and various difficulties involved in knowing it, but "something you are" is only every a fancy way of presenting something you know (because if you know it, you can generally forge it with reasonable effort) and "something you have"…

I don't think this is right. If there's a shared secret like a TOTP seed, that's in theory a "something you know", but if I don't know it, then who does? The point of "something you have" is that you own a device that "knows" it for you, and you never even need to see or expose the underlying secret, you just copy a token proving that the device you have knows the secret. I think that does count as an additional factor.

Of course if someone is memorizing the TOTP seed and generating the proof on the fly every time, then there's no shift in factor, but no one is doing that. And if they're saving the password on the same device that stores the TOTP code, then we're back to one factor, but now it's just 2x "something you have" at that point.

Re: The "email is authentication" pattern

#128

Post by suprjami »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I use a web service which does this. It's mildly annoying having to switch apps/tabs just to login, but hey at least it's not another password to remember.

Re: The "email is authentication" pattern

#129

Post by rembicilious »

hansvm wrote: post #22
ydnaclementine wrote: post #17

Earlier quoted context omitted.

The most secure password is no password

Totally agreed. The account though, that's another question. Would you mind sharing the username of your favorite passwordless account?

Personally, I don’t care to share the username to any account, password protected or not. On a related note I think it is terrible security to have display name be the same as user login name.

Re: The "email is authentication" pattern

#130

Post by noAnswer »

hnbad wrote: post #107
terribleperson wrote: post #82

Earlier quoted context omitted.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

Germany has PostIdent: you are issued a code, take it to the closest post office, hand them the code (originally this involved printouts) and your ID card and they scan your ID card and enter it into their system where the issuer of the code can then request that info to verify your identity. This has largely been replaced by videochat for ID card verification where some underpaid person walks you through holding you…

Or you hold our ID card to your phone and do it on the spot.

https://www.deutschepost.de/en/p/postident/geschaeftskunden/...

Post reply on HN