Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

221–230 of 474 posts

Re: The "email is authentication" pattern

#221

Post by xboxnolifes »

jacinda wrote: post #219
thaumasiotes wrote: post #216

Earlier quoted context omitted.

> This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users. This would make currency fundamentally incompatible with real users. Reality says otherwise.

Currency in the real world has many, many backups. For example, if I forgot the PIN number to a very old bank account that I later find a long lost relative recently put hundreds of thousands of dollars into when they passed away, I have other avenues to recover access. They might be annoying or require work (getting an affidavit, multiple forms of ID, etc) but it's not irrevocable in the way that a strict definition…

A bank account is not currency. Cash is. You can still put cryptocurrency in a bank if you so choose.

Re: The "email is authentication" pattern

#222

Post by firesteelrain »

boneitis wrote: post #103
gerdesj wrote: post #68

Earlier quoted context omitted.

Auth apps are crap - each one pretends to be unique and authoritative. TOTP secrets are a string, not just a QR code that can only be seen once and never again - the QR code merely encodes that string! That string can be used in multiple places to generate codes. KeepassXC can do it and that can be shared. I've seen loads of organisations and sites with an elderly mobile phone that has the TOTP auth app on it. Normal…

A little off-topic from the matter of adoption and usability by the greater masses, but I personally prefer these RFC 6238 TOTPs that I have the choice to take into my own hands, as opposed to internet-required, server-side based like my banking app and Okta. I have a copy of all my TOTP generators (minus my dev Okta account) in a common authenticator app and an offline copy stored in an offline password manager, fur…

I thought the Authenticator apps were great until I upgraded my iPhone and the apps lost all of my Authenticator setups. Good thing it wasn’t super critical.

Re: The "email is authentication" pattern

#223

Post by archerx »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I hate this with a passion and many sites use it like anthropic and clipdrop, I stopped buying credits on Clipdrop because logging in was so annoying. My email is on my phone and I want to access the site on my laptop. This adds so much friction and turns a 5 second task with one to two clicks into a longer than a minute task with many clicks. I emailed anthropic about this and they did added a login with google option but just let us use an email and password please.

Re: The "email is authentication" pattern

#224

Post by archerx »

suprjami wrote: post #128
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I use a web service which does this. It's mildly annoying having to switch apps/tabs just to login, but hey at least it's not another password to remember.

Remembering passwords is easy this is just just convoluted and stupid.

Re: The "email is authentication" pattern

#225

Post by archerx »

byteflip wrote: post #61
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I'm coding up a webapp with this exact login process - the issue I've found is on mobile phones - apps like gmail won't let you copy the link into a browser without a preview. The preview consumes the link. (next.js auth) It's a bit annoying, since I don't want to login into the gmail in-app browser, I want to login on my regular browser.

I will be sure not never use your webapp just because of the email login system.

Re: The "email is authentication" pattern

#226

Post by [deleted] »

rendaw wrote: post #181
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I've heard that a lot about cryptocurrency, but aren't there plenty of cryptocurrency users who have never lost their wallet and have good personal opsec? Maybe the issue is trying to force one solution for everyone.

[deleted]

Re: The "email is authentication" pattern

#227

Post by archerx »

wyager wrote: post #180
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

A lot of sites do this, annoyingly. I hate when my internet experience is degraded because the bottom pentile of users can't figure out how to do something.

Yes, why must the majority suffer because a few dumb dumbs can’t remember their passwords? We need to subsidizing stupidity or else we will get more stupidity.

Re: The "email is authentication" pattern

#228

Post by mewpmewp2 »

archerx wrote: post #224
suprjami wrote: post #128

Earlier quoted context omitted.

I use a web service which does this. It's mildly annoying having to switch apps/tabs just to login, but hey at least it's not another password to remember.

Remembering passwords is easy this is just just convoluted and stupid.

Since you wouldn't want to reuse passwords how is it to remember them?

Re: The "email is authentication" pattern

#229

Post by archerx »

al_borland wrote: post #83

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

I have stopped giving websites money because the friction of using magic links was too much and I found alternatives that didn’t involve such a dumb login system.

My theory is if you can’t make a proper login system you’re skills probably aren’t good enough to deliver on what you’re promising. Magic links have turned from an annoyance to a filter for me.

Re: The "email is authentication" pattern

#230

Post by archerx »

seanthemon wrote: post #88
al_borland wrote: post #83

I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.

Or maybe password managers need to catch up with this newly forming flow

Or this stupid flow needs to die.
Post reply on HN