Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

181–190 of 474 posts

Re: The "email is authentication" pattern

#181

Post by rendaw »

simonw wrote: post #120
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I've heard that a lot about cryptocurrency, but aren't there plenty of cryptocurrency users who have never lost their wallet and have good personal opsec?

Maybe the issue is trying to force one solution for everyone.

Re: The "email is authentication" pattern

#182

Post by airstrike »

rendaw wrote: post #181
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I've heard that a lot about cryptocurrency, but aren't there plenty of cryptocurrency users who have never lost their wallet and have good personal opsec? Maybe the issue is trying to force one solution for everyone.

The claim that most humans are prone to losing keys isn't negated by the existence of some humans that have (so far) been able to keep their keys.

Re: The "email is authentication" pattern

#183

Post by rakkhi »

tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Maybe we should support logging in with an OTP to email for many more systems than we do currently? Combined with conditional access and MFA its actually not bad.

No password to remember and supports this "pattern"

Re: The "email is authentication" pattern

#184

Post by ta_1138 »

onethought wrote: post #147
iamthepieman wrote: post #143

Earlier quoted context omitted.

You didn't lose your entire savings if you lost your wallet, usually.

Perhaps micro wallets should be a thing where your wealth is distributed across many keys mitigating some loss.

At which point I gained the problem of having to keep track of all of my microwallets securely, hopefully in a way that survives my phone being lost, a house fire, or my untimely death, leaving the wealth to inheritors. All while, at the same time, not ending up behind a single key that has access to all the information to those micro wallets.

Quickly you end up in a situation that either starts to look like how financial companies keep their most high risk keys, or end up outsourcing the whole thing to something that quickly starts to resemble your bank.

So ultimately it's just like cash: Fine for small amounts. Risky, but maybe livable for somewhat larger accounts, or a giant headache that will probably bite you when you start looking at lifetime savings.

Re: The "email is authentication" pattern

#185

Post by thbb123 »

terribleperson wrote: post #82
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

The french postal services does that and includes a digital wallet and cloud repository.for instance, my paycheck certificates are delivered on this wallet.

Besides, the french administration is providing its own global scheme for online authentication.

Right now it works for all public services, but it is also open to all willing businesses.

It makes it also very easy to control tightly what kind of information is distributed to various services and businesses.

Re: The "email is authentication" pattern

#187

Post by dqv »

melody_calling wrote: post #152

I hadn't realised until reading this, that I use this exact method for Best Buy. Not intentionally though - I have my password stored in 1Password, so I know it's correct, yet every time I try to purchase something through bestbuy.com I trip some sort of ATO protection that falsely claims my password is invalid. I'm entirely willing to believe it's something on my side (ad blocker, local DNS blacklisting, etc.) but a…

> Not intentionally though - I have my password stored in 1Password, so I know it's correct, yet every time I try to purchase something through bestbuy.com I trip some sort of ATO protection that falsely claims my password is invalid.

Are you sure it's not a maxlength mismatch? It is very common to have the "change password" field to have a different (or no) maxlength and then have the login page have a different maxlength. So you change your password to some 60 character password, then you log in where the maxlength is only 40 characters... wrong password! I actually have a policy now of having the maxlength stored in application config so it propagates to all password fields in my apps.

Edit: Just checked and yes there is a length mismatch (form to set password has maxlength of 54, but login page has no maxlength set). So if your password length is > 54 and 1Password doesn't automatically cut the password it stores to 54 characters or fewer, you won't be able to log in.

Re: The "email is authentication" pattern

#188

Post by 8organicbits »

rahimnathwani wrote: post #170
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. It won't work for 99.99% of services, but it can work if your service is huge. WeChat uses a mechanism like this, and it works well.

I'm not familiar, which part of the comment does WeChat implement?

Re: The "email is authentication" pattern

#189

Post by rahimnathwani »

8organicbits wrote: post #188
rahimnathwani wrote: post #170

Earlier quoted context omitted.

If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. It won't work for 99.99% of services, but it can work if your service is huge. WeChat uses a mechanism like this, and it works well.

I'm not familiar, which part of the comment does WeChat implement?

A panel of peers.

Re: The "email is authentication" pattern

#190

Post by abdullahkhalids »

seanthemon wrote: post #88
al_borland wrote: post #83

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

Or maybe password managers need to catch up with this newly forming flow

Keepassxc (and its browser extension) can do this easily. You just have to one time define that the website only takes a username field. After that it will autofill the correct email in the field.
Post reply on HN