The "email is authentication" pattern • Hacker News Board

Re: The "email is authentication" pattern

#141

Post by JadeNB » Sun, Sep 08, 2024, 1:35 AM UTC

jerf wrote: post #111

JonChesterfield wrote: post #106

Earlier quoted context omitted.

One flaw is I'm pretty sure a lot gmail account is lost forever. Contacting Google to retrieve access would not go well. Related is that if you try to self host email your messages are unlikely to reach anyone.

Self-hosting outbound email is hard. Self-hosting inbound email is trivial. Anybody will send email to any random domain, they're just not willing to accept it from random sources. And the latter is what is relevant for password recovery. I self-host inbound but use established servers for outbound through my ISP and have had no trouble with that setup for a while. Forwarding to people through my domain has gotten a…

> Self-hosting inbound email is trivial. Anybody will send email to any random domain, they're just not willing to accept it from random sources.

In terms of authentication, this is not entirely true. It's less common these days, but I used to have a lot of trouble with sites rejecting my attempts to create accounts with e-mail addresses from my disposable-e-mail-generator of choice.

Re: The "email is authentication" pattern

#142

Post by mozzieman » Sun, Sep 08, 2024, 1:35 AM UTC

A physical key you have put in your computer and store on your keychain.

Re: The "email is authentication" pattern

#143

Post by iamthepieman » Sun, Sep 08, 2024, 1:37 AM UTC

j-bos wrote: post #139

simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I don't know, we carried physical money for millenia. Humans managed that.

You didn't lose your entire savings if you lost your wallet, usually.

Re: The "email is authentication" pattern

#144

Post by IggleSniggle » Sun, Sep 08, 2024, 1:44 AM UTC

j-bos wrote: post #139

simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I don't know, we carried physical money for millenia. Humans managed that.

Physical money is physically recoverable after lost

Re: The "email is authentication" pattern

#145

Post by noAnswer » Sun, Sep 08, 2024, 1:47 AM UTC

rangestransform wrote: post #136

eaglemfo wrote: post #96

Earlier quoted context omitted.

The german gov ids actually have a way to issue pseudonymous tokens where websites can only see that you are the same person as last time. You can't make 2 accounts on the same site if sich things are unwanted. You can't link accounts across providers. How it works under the hood? No specific idea. I wonder if its sound.

The problem is the government can then definitively associate all your accounts with your real identity

How does the government know which token a ID card generated? The ID card itself generates (for each service a different one) and encrypts it. Not even the card reader can read it. It is a encrypted channel between the card and the ID-server for the site/service. The pseudonym function does not identify a person but a card.

Re: The "email is authentication" pattern

#146

Post by onethought » Sun, Sep 08, 2024, 1:47 AM UTC

IggleSniggle wrote: post #144

j-bos wrote: post #139

Earlier quoted context omitted.

I don't know, we carried physical money for millenia. Humans managed that.

Physical money is physically recoverable after lost

No it isn’t. No more than a wallet key.

If I lose $1 note. It’s gone. If I recover it, then it’s no longer lost.

Re: The "email is authentication" pattern

#147

Post by onethought » Sun, Sep 08, 2024, 1:48 AM UTC

iamthepieman wrote: post #143

j-bos wrote: post #139

Earlier quoted context omitted.

I don't know, we carried physical money for millenia. Humans managed that.

You didn't lose your entire savings if you lost your wallet, usually.

Perhaps micro wallets should be a thing where your wealth is distributed across many keys mitigating some loss.

Re: The "email is authentication" pattern

#148

Post by deisteve » Sun, Sep 08, 2024, 1:52 AM UTC

not sure i get what this article's point is

its the go to pattern because its the most resilient and intuitive

we've been using emails for a long time and it makes sense that it became the go to authentication method

Re: The "email is authentication" pattern

#149

Post by FireBeyond » Sun, Sep 08, 2024, 1:59 AM UTC

alberth wrote: post #135

terribleperson wrote: post #82

Earlier quoted context omitted.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

To get a RealID drivers license in the US, which will be required to board a plane soon, requires all of the above and more. It’s a government in-person KYC.

The irony with that is that if someone undocumented wanted to leave the country, this requirement could potentially hinder that.

I also don't really want to have to carry my green card around everywhere. Just one more thing that can be lost.

Re: The "email is authentication" pattern

#150

Post by blahedo » Sun, Sep 08, 2024, 2:01 AM UTC

j-bos wrote: post #139

simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I don't know, we carried physical money for millenia. Humans managed that.

Yes, by evolving banks to solve some of the problems of lugging around lots of cash and/or stuffing it in a trunk in your house. And assuming you are known at your bank and/or can (eventually) prove your identity there, you don't have the same "lost wallet" problem being discussed here.