Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

131–140 of 474 posts

Re: The "email is authentication" pattern

#131

Post by hn_throwaway_99 »

j45 wrote: post #81
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

A pattern to make signups faster doesn't make them secure. Magic links can be more like convenience links, not secure, or security.

I'd argue at this point that magic links are more secure:

1. Nearly every online service needs some sort of "forgot password" flow, and often times that flows boils down to what is essentially a magic link like TFA is about.

2. The vast majority of users these days use either personal email accounts from one of the big providers (Google, Yahoo, MS), or they use corporate accounts often through a hosted solution. 9 times out of 10 I'd bet the email provider has better security than whatever rinky dink website you may be creating an account on.

Emailing magic links is essentially "poor man's SSO". It makes much more sense IMO to have super secure email accounts (e.g. ideally with passkeys) and then just use magic links for everything else.

Re: The "email is authentication" pattern

#133

Post by marcosdumay »

jerf wrote: post #113
gerdesj wrote: post #68

Earlier quoted context omitted.

Auth apps are crap - each one pretends to be unique and authoritative. TOTP secrets are a string, not just a QR code that can only be seen once and never again - the QR code merely encodes that string! That string can be used in multiple places to generate codes. KeepassXC can do it and that can be shared. I've seen loads of organisations and sites with an elderly mobile phone that has the TOTP auth app on it. Normal…

I'm increasingly coming around to the idea that in reality, there's only one factor, at least as far as the Internet is concerned: Something you know. There's different ways of knowing it and various difficulties involved in knowing it, but "something you are" is only every a fancy way of presenting something you know (because if you know it, you can generally forge it with reasonable effort) and "something you have"…

Yes, if you don't control the hardware at the user's end, the only factor you can get is "something you know".

All the things around improving web authentication are just about people not having to memorize that something you know and protecting it against eavesdroppers.

Re: The "email is authentication" pattern

#135

Post by alberth »

terribleperson wrote: post #82
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

To get a RealID drivers license in the US, which will be required to board a plane soon, requires all of the above and more.

It’s a government in-person KYC.

Re: The "email is authentication" pattern

#136

Post by rangestransform »

eaglemfo wrote: post #96
aucisson_masque wrote: post #72

Earlier quoted context omitted.

> Government provided digital IDs Oh man, that sounds like a terrible idea privacy wise. Every website would make use of it to track it's user.

The german gov ids actually have a way to issue pseudonymous tokens where websites can only see that you are the same person as last time. You can't make 2 accounts on the same site if sich things are unwanted. You can't link accounts across providers. How it works under the hood? No specific idea. I wonder if its sound.

The problem is the government can then definitively associate all your accounts with your real identity

Re: The "email is authentication" pattern

#137

Post by JadeNB »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

> Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

Sadly, the US government goes the other way and contracts out verification (to government websites!) to an invasive private company.

Re: The "email is authentication" pattern

#138

Post by PaulHoule »

Any strong 2 factor authentication without the kind of high touch processes that a bank can afford is a corporate suicide pact. 10% or so of your users will be permanently locked out each year and once you get past the early explosive early growth phase that turns into a near steady state instead you get radioactive decay.

Re: The "email is authentication" pattern

#139

Post by j-bos »

simonw wrote: post #120
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I don't know, we carried physical money for millenia. Humans managed that.
Post reply on HN