Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

231–240 of 474 posts

Re: The "email is authentication" pattern

#231

Post by taneq »

aucisson_masque wrote: post #72
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

> Government provided digital IDs Oh man, that sounds like a terrible idea privacy wise. Every website would make use of it to track it's user.

I read this as tongue-in-cheek at first (since most web sites do their darnedest to track their users, and having a log-on kind of requires this anyway).

A centralized authentication system like this wouldn't need to be a single consistent UUID per person which was then passed around. Presumably you'd have a central login to authenticate you to the system, and then the system could create separate 'id' tokens per web site or whatever that the user logs in to.

Re: The "email is authentication" pattern

#233

Post by kalleboo »

jerf wrote: post #113
gerdesj wrote: post #68

Earlier quoted context omitted.

Auth apps are crap - each one pretends to be unique and authoritative. TOTP secrets are a string, not just a QR code that can only be seen once and never again - the QR code merely encodes that string! That string can be used in multiple places to generate codes. KeepassXC can do it and that can be shared. I've seen loads of organisations and sites with an elderly mobile phone that has the TOTP auth app on it. Normal…

I'm increasingly coming around to the idea that in reality, there's only one factor, at least as far as the Internet is concerned: Something you know. There's different ways of knowing it and various difficulties involved in knowing it, but "something you are" is only every a fancy way of presenting something you know (because if you know it, you can generally forge it with reasonable effort) and "something you have"…

The way I see it, the main security benefit of TOTP is it's a very long, high-entropy password that is guaranteed to never be re-used.

Re: The "email is authentication" pattern

#234

Post by archerx »

doctorpangloss wrote: post #18
threatofrain wrote: post #2

People have already been building auth flows that take this password amnesia into consideration. Look at Anthropic. It's just one way of doing auth and I personally hate it.

Anthropic and others do this to inconvenience account sharing. It’s not really about auth, it’s about licenses…

There are much smarter ways of doing this.

Re: The "email is authentication" pattern

#235

Post by archerx »

monus wrote: post #114

Well, yeah, “magic link” is a thing and one of the easiest form of authentication supported by many providers, like Supabase, Vercel and libraries like Next Auth. Another great side effect is that your backend doesn’t have to store user passwords which means removal of a lot of compliance headaches.

You should never store passwords in any case. Hash + Salt.

Re: The "email is authentication" pattern

#236

Post by gloosx »

>why they do this

There is always a simple answer to such question, and it's usually about some inconvenience the service provider decided to set-up for the user. In this particular case I think the answer is obvious: email provider usually have a session which never really ends, and just sits there logged in unless the browser cache is wiped.

Make your service auth token to live for the same time as Gmail's, and as an alternative give users an ability to just login with OTP every time, but stop these unholy 12 hrs time-to-live auth token practices - your users will never log-in via password restore again.

Re: The "email is authentication" pattern

#237

Post by archerx »

runako wrote: post #199

Disclaimer: I loathe this pattern & hope something like WebAuthn prevails instead. That said, if folks are going to adopt this as a primary flow, perhaps email clients need to build in support. For OS providers like Apple, maybe this means less emphasis on the easy Passkey method and more on fixing the finicky email login flow that sites use instead? What would a good email login flow look like? What is the "password…

A good email login flow is where I put my email and then my password then click login. Anything else is pure wankery

Re: The "email is authentication" pattern

#238

Post by jjmarr »

xboxnolifes wrote: post #221
jacinda wrote: post #219

Earlier quoted context omitted.

Currency in the real world has many, many backups. For example, if I forgot the PIN number to a very old bank account that I later find a long lost relative recently put hundreds of thousands of dollars into when they passed away, I have other avenues to recover access. They might be annoying or require work (getting an affidavit, multiple forms of ID, etc) but it's not irrevocable in the way that a strict definition…

A bank account is not currency. Cash is. You can still put cryptocurrency in a bank if you so choose.

It's a lot harder for the average person to lose 1 million dollars in cash than in Bitcoin because humans naturally understand the exchange of physical objects.

If I have a duffel bag of money, it is obvious that physical possession of the bills means I can access its value. Anything negating that possession would cost me my money. I should probably keep it away from open flames and water; but it's not going to spontaneously combust. A thief would need to physically take the money in the duffel bag for me to lose the value.

Meanwhile if I store Bitcoin on a USB drive the drive might randomly fail and I lose all my money (because I'm actually storing a key to access it) even though I still have the USB stick. The solution is to back up my key in multiple places simultaneously, which doesn't make sense to most people (how can money be in two places at once?)

If I plug the USB stick into the wrong computer, someone can steal all my money (because they can find out what the key is) without me ever losing the USB stick.

Virtually every human on Earth understands the notions of object permanence and that objects can be exchanged for other objects. This is intuitive from evolution and actual monkeys can comprehend physical currency.[1] I don't see how cryptocurrency can be on that level.

[1]. https://www.zmescience.com/research/how-scientists-tught-mon...

Re: The "email is authentication" pattern

#240

Post by fragmede »

jjmarr wrote: post #238
xboxnolifes wrote: post #221

Earlier quoted context omitted.

A bank account is not currency. Cash is. You can still put cryptocurrency in a bank if you so choose.

It's a lot harder for the average person to lose 1 million dollars in cash than in Bitcoin because humans naturally understand the exchange of physical objects. If I have a duffel bag of money, it is obvious that physical possession of the bills means I can access its value. Anything negating that possession would cost me my money. I should probably keep it away from open flames and water; but it's not going to spont…

The concept that this file is the password to the money isn't too complicated. The money isn't in two places at once, the file's the password to it.
Post reply on HN