Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

171–180 of 474 posts

Re: The "email is authentication" pattern

#171

Post by esafak »

al_borland wrote: post #83

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

It means the site doesn't store your password, so you have less to worry about.

Re: The "email is authentication" pattern

#172

Post by Eddieethan »

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

[flagged]

Re: The "email is authentication" pattern

#173

Post by 8organicbits »

packetlost wrote: post #159

With email being the source of identity on the internet, it's really unfortunate that the standards have largely lagged heavily behind when it comes to stronger authentication algorithms. Why is SMTP still plaintext on port 25 for MTA MTA? Why is STARTTLS really the best we can do? Why do we not support 2FA or mTLS or passkeys or any one of the other modern authentication mechanisms or IMAP4, SMTP, etc.. ProtonMail i…

Worth looking at MTA-STS. I think DANE is on the way out, but it looked promising for a while.

Re: The "email is authentication" pattern

#174

Post by kmoser »

terribleperson wrote: post #82
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

No, thank you. I don't want anybody with a fake ID of me to be able to take control of my email. I want to use my password, I want it strongly encrypted at rest, and I want to be able to reset it remotely any time of day, without waiting for the USPS office to open.

Re: The "email is authentication" pattern

#175

Post by terribleperson »

kmoser wrote: post #174
terribleperson wrote: post #82

Earlier quoted context omitted.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

No, thank you. I don't want anybody with a fake ID of me to be able to take control of my email. I want to use my password, I want it strongly encrypted at rest, and I want to be able to reset it remotely any time of day, without waiting for the USPS office to open.

Is a fake ID going to fly at the post office, where they can scan them? Also, I was imagining they'd want more than just an ID.

edit: Also also, they have to go into a physical post office and be observed trying to steal your account. Given how it's quite possible to steal accounts via social engineering, this seems like an improvement in security, not a reduction.

Re: The "email is authentication" pattern

#176

Post by [deleted] »

noAnswer wrote: post #145
rangestransform wrote: post #136

Earlier quoted context omitted.

The problem is the government can then definitively associate all your accounts with your real identity

How does the government know which token a ID card generated? The ID card itself generates (for each service a different one) and encrypts it. Not even the card reader can read it. It is a encrypted channel between the card and the ID-server for the site/service. The pseudonym function does not identify a person but a card.

[deleted]

Re: The "email is authentication" pattern

#177

Post by noAnswer »

jack_pp wrote: post #168
noAnswer wrote: post #145

Earlier quoted context omitted.

How does the government know which token a ID card generated? The ID card itself generates (for each service a different one) and encrypts it. Not even the card reader can read it. It is a encrypted channel between the card and the ID-server for the site/service. The pseudonym function does not identify a person but a card.

If it identifies the card and the govt can identify you by your card then isn't it by definition identifying the person?

The government doesn't know which card a token from a "pseudonym function" belongs to. The government can identify a person when the ID function was used, of course.

Again, it is a random token the card generates internally for each service. It is non transferable! If you get a new ID card, you can't use it login to whatever you used your old card for. (You would need something else... say an email :-) to tie the knot back to the old identity or whatever.) Which makes this function, the pseudonym function, very bad for random accounts (Edit: meaning longer lasting online identities like forums or whatever). I guess eaglemfo didn't knew.

It's more for like "yes, yes, I'm an adult, now give me this pr0n movie which I pay for with my anonym prepaid card" kind of deals.

Re: The "email is authentication" pattern

#178

Post by chrisweekly »

alberth wrote: post #135
terribleperson wrote: post #82

Earlier quoted context omitted.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

To get a RealID drivers license in the US, which will be required to board a plane soon, requires all of the above and more. It’s a government in-person KYC.

Passport will also work

Re: The "email is authentication" pattern

#179

Post by lolinder »

j-bos wrote: post #139
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I don't know, we carried physical money for millenia. Humans managed that.

Money occupies physical space, so for most of history there was a pretty low cap on how much you could bring with you at once, which placed a cap on how much a single mistake could cost you.

Re: The "email is authentication" pattern

#180

Post by wyager »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

A lot of sites do this, annoyingly. I hate when my internet experience is degraded because the bottom pentile of users can't figure out how to do something.
Post reply on HN