Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

201–210 of 474 posts

Re: The "email is authentication" pattern

#201

Post by zaphirplane »

lolinder wrote: post #179
j-bos wrote: post #139

Earlier quoted context omitted.

I don't know, we carried physical money for millenia. Humans managed that.

Money occupies physical space, so for most of history there was a pretty low cap on how much you could bring with you at once, which placed a cap on how much a single mistake could cost you.

> cap on how much you could bring

Bring to where ? Are you mapping the crypto wallet concept to the physical wallet concept as a mobile storage concept ?

All your money is the limit, however you store it.

Re: The "email is authentication" pattern

#202

Post by aborsy »

thbb123 wrote: post #185
terribleperson wrote: post #82

Earlier quoted context omitted.

I think I've said it before, but I want USPS-provided email. To set one up you'd go to a post office, verify your identity in some way, and set up an email. If you forget your password and want to recover it, you'd have to go back into a post office and verify your identity again.

The french postal services does that and includes a digital wallet and cloud repository.for instance, my paycheck certificates are delivered on this wallet. Besides, the french administration is providing its own global scheme for online authentication. Right now it works for all public services, but it is also open to all willing businesses. It makes it also very easy to control tightly what kind of information is d…

What are the names of these services, to see how they work, their recovery process and abuse prevention?

Re: The "email is authentication" pattern

#203

Post by pflenker »

I used to follow this process for many of my logins (the less critical ones) before password managers were mainstream, and it was a conscious decision to do so.

It’s more secure than a) reusing an existing password everywhere and b) setting a trivial password that _just_ passes the site’s password requirements.

You can’t expect me to memorize all passwords for all different logins, especially the ones for less important sites, and especially if these sites impose their ridiculous password restrictions on me.

Re: The "email is authentication" pattern

#204

Post by wpm »

rendaw wrote: post #181
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I've heard that a lot about cryptocurrency, but aren't there plenty of cryptocurrency users who have never lost their wallet and have good personal opsec? Maybe the issue is trying to force one solution for everyone.

The issue in not trying to force one solution for everyone becomes a blocker when you intend on making some technology useful and essential to everyone, hence, no one seriously gives a damn about crypto anymore.

Re: The "email is authentication" pattern

#205

Post by wpm »

seanthemon wrote: post #88
al_borland wrote: post #83

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

Or maybe password managers need to catch up with this newly forming flow

Perhaps, a password manager managed email address used solely for these stupid links and codes.

Why email then? Why not some other, better protocol?

Why not just use a TOTP at that point?

Re: The "email is authentication" pattern

#206

Post by j45 »

hn_throwaway_99 wrote: post #131
j45 wrote: post #81

Earlier quoted context omitted.

A pattern to make signups faster doesn't make them secure. Magic links can be more like convenience links, not secure, or security.

I'd argue at this point that magic links are more secure: 1. Nearly every online service needs some sort of "forgot password" flow, and often times that flows boils down to what is essentially a magic link like TFA is about. 2. The vast majority of users these days use either personal email accounts from one of the big providers (Google, Yahoo, MS), or they use corporate accounts often through a hosted solution. 9 ti…

Learning how to password effectively is something that comes up in B2B in many non trivial software.

Magic link is effectively passwordless login, behind a facade outsourced to a third party provider.

Passwords are much more actual consent, than clicking on a link in an email account that might be open on a screen or device... not always.

SSO is technically easier than poor man's sso, it's just one click once logged in. Magic links make me switch a screen to make it easier for the developers of Magic Link to not implement SSO.

Fingerprints are a username, not a username+password. It's super convenient, but well established not secure.

Face-ID logins are more a username, should not be a username+password - selling it as secure is not ideal, but it is super convenient.

SMS verifications too, are a little weak, since SMS' generally are like post cards. But they are very convenient. Until someone does something to get malware into your phone, or your phone number itself which seems to happen so often.

Now, magic links are very convenient. And definitely can remove friction to you know, get a user onboarding to the point of adoption.

Re: The "email is authentication" pattern

#207

Post by lelanthran »

j-bos wrote: post #139
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I don't know, we carried physical money for millenia. Humans managed that.

> I don't know, we carried physical money for millenia. Humans managed that.

Yeah, but if I lose the physical 100$ I am carrying, that doesn't prevent me from accessing the rest of my cash stored elsewhere.

I've never lost access to the rest of my cash stored elsewhere.

Re: The "email is authentication" pattern

#208

Post by paradox460 »

j45 wrote: post #79
nfw2 wrote: post #30

Earlier quoted context omitted.

Can you expand what you mean when you say the security of phone numbers is leagues below email? If someone can gain access to someone's phone, it seems like they would gain access to their email as well.

SMS codes for anything are not secure. Convenience over security, maybe. SMS are as secure as a letter compared to a postcard.

And they're rather irritating to boot. TOTP authentication in something like keypass or 1password is very low friction, working automatically in ideal circumstances. Sms based ones are kludgy

Re: The "email is authentication" pattern

#209

Post by al_borland »

EasyMark wrote: post #155
al_borland wrote: post #83

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

I get this a lot because I use Mullvad 99%of the time. I hate it, but I put up with it because I don’t have much choice. I guess they’re flagging the “popular” ip address that I’m using.

If it’s only doing it because of your VPN, I think I’m talking about something else.

This isn’t where you put in a username and password, then get an email code prompt because something looks off.

In the case I’m talking about, the user has no password. This is just the way it is, VPN or not.

Re: The "email is authentication" pattern

#210

Post by al_borland »

esafak wrote: post #171
al_borland wrote: post #83

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

It means the site doesn't store your password, so you have less to worry about.

That’s the reason I can understand why they do it. It’s less information they are holding on to, and they effectively outsource authentication to the email provider.
Post reply on HN