The "email is authentication" pattern • Hacker News Board

Re: The "email is authentication" pattern

#161

Post by gunapologist99 » Sun, Sep 08, 2024, 2:22 AM UTC

packetlost wrote: post #159

With email being the source of identity on the internet, it's really unfortunate that the standards have largely lagged heavily behind when it comes to stronger authentication algorithms. Why is SMTP still plaintext on port 25 for MTA MTA? Why is STARTTLS really the best we can do? Why do we not support 2FA or mTLS or passkeys or any one of the other modern authentication mechanisms or IMAP4, SMTP, etc.. ProtonMail i…

And why, in 2024, is requiring any encryption at all a violation of RFC 5321, thus making any MITM literally a trivial and impossible to defeat downgrade attack?

Re: The "email is authentication" pattern

#162

Post by Terretta » Sun, Sep 08, 2024, 2:23 AM UTC

prng2021 wrote: post #6

“It offers a guaranteed, repeatable, low-effort solution” Doesn’t this answer the question? I would have preferred to read and discuss what they believe to be better alternatives.

> whether we can take advantage of people’s tendencies towards learned behaviour like this

See, thoughts like that turn into billion dollar valuations at Series B for, among other things, a login button that emails you a login link, taking advantage of people's tendencies towards behavior like this:

https://stytch.com/products/email-magic-links

https://stytch.com/blog/announcing-series-b/

(Or maybe turn into Tell HN posts on common SaaS vulns, like https://news.ycombinator.com/item?id=33162854, but point is lots of companies offer this including most SaaS-y IdPs, search: passwordless email magic link, it's not new: https://auth0.com/blog/auth0-passwordless-email-authenticati... ...)

Re: The "email is authentication" pattern

#163

Post by charles_f » Sun, Sep 08, 2024, 2:29 AM UTC

The thing is, the moment some service allows you to recover your password through email, this becomes a legitimate pattern. As long as the throwaway password is reasonably complex, the service becomes as secure as email can be (which is, imperfect)

Re: The "email is authentication" pattern

#164

Post by gunapologist99 » Sun, Sep 08, 2024, 2:29 AM UTC

For seldom used (or cared about) accounts, this is pretty low friction, and most of those will keep you logged in for an extended period of time.

From a perspective of one of these people, why even bother with trying to remembering a login or dealing with tools you don't have, like if you don't even have a password manager or know that they exist.

From a systems and security perspective, it could be worse. They could be reusing passwords.

Re: The "email is authentication" pattern

#165

Post by csomar » Sun, Sep 08, 2024, 2:33 AM UTC

> and whether we can take advantage of people’s tendencies towards learned behaviour like this.

Isn't that what some services are doing already? There is no password in Notion, you just enter your email and the password is sent to your email address.

Login with Email is like a primitive "Login with Google" where the user himself transfer the authentication token. It's still better in one area: no lockdown to a particular cloud provider. However, it doesn't address security, it just concentrate it in one place. Lose your email and now you have a much bigger problem.

Re: The "email is authentication" pattern

#166

Post by tbrownaw » Sun, Sep 08, 2024, 2:34 AM UTC

alberth wrote: post #135

terribleperson wrote: post #82

Earlier quoted context omitted.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

To get a RealID drivers license in the US, which will be required to board a plane soon, requires all of the above and more. It’s a government in-person KYC.

> which will be required to board a plane soon

Assuming that this time the deadline doesn't get pushed back at the last minute again like has kept happening so far.

Re: The "email is authentication" pattern

#167

Post by MadnessASAP » Sun, Sep 08, 2024, 2:35 AM UTC

onethought wrote: post #146

IggleSniggle wrote: post #144

Earlier quoted context omitted.

Physical money is physically recoverable after lost

No it isn’t. No more than a wallet key. If I lose $1 note. It’s gone. If I recover it, then it’s no longer lost.

A $1 note being a macro scale physical object enjoys a variety of benefits such as object permanence which provide a baseline level of recoverability. Whereas a wallet key l, being a number, enjoys no such protections.

Of course you may choose to encode your wallet key on paper, metal, or stone granting it properties not unlike a note. However you have now compromised the security of your wallet as well it becomes no mere $1 note, rather it is a note that represents all or a significant fraction of your net worth.

Re: The "email is authentication" pattern

#168

Post by jack_pp » Sun, Sep 08, 2024, 2:35 AM UTC

noAnswer wrote: post #145

rangestransform wrote: post #136

Earlier quoted context omitted.

The problem is the government can then definitively associate all your accounts with your real identity

How does the government know which token a ID card generated? The ID card itself generates (for each service a different one) and encrypts it. Not even the card reader can read it. It is a encrypted channel between the card and the ID-server for the site/service. The pseudonym function does not identify a person but a card.

If it identifies the card and the govt can identify you by your card then isn't it by definition identifying the person?

Re: The "email is authentication" pattern

#169

Post by kfrzcode » Sun, Sep 08, 2024, 2:37 AM UTC

simonw wrote: post #122

kfrzcode wrote: post #75

Earlier quoted context omitted.

The Decentralized Recovery (DeRec) Alliance has recently launched to solve this very problem. Dr. Leemon Baird gave a talk last year on how this works at a higher level [0]. The alliance is comprised of members from the Algorand, Hedera, Ripple crypto communities but the application of proper DeRec would be certainly applicable anywhere you have any type of secret; in fact I believe you can be a DeRec 'helper' right…

Some day someone is going to produce a fantastic heist movie about breaking this kind of scheme - five different characters, each of which need to be scammed in different ways to obtain their piece of a shared secret. Sadly it's quite possible this will be a dramatized version of a real-world event. We've already seen quite a few messed up crimes to steal keys to steal crypto. Secret sharing just means you need to ki…

But in fact, in order to kidnap these people you'd also need to know these people, and know they are assigned to be part of the derec network. With DeRec all the helpers don't need to know about each other at all. And you may not know how many helpers a given helper has behind them. It's actually much much more difficult to do the heist-and-interrogate-with-a-pipe-wrench approach if you don't know who to beat up, nor how many of them need to authenticate.

Edit: OT but while I have a glimpse of your attention, kudos in order!! I love datasette and basically everything you write is highly useful to me!

Re: The "email is authentication" pattern

#170

Post by rahimnathwani » Sun, Sep 08, 2024, 2:38 AM UTC

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

  If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans.

It won't work for 99.99% of services, but it can work if your service is huge. WeChat uses a mechanism like this, and it works well.