Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

281–290 of 474 posts

Re: The "email is authentication" pattern

#281

Post by ChrisMarshallNY »

Login and authentication are a really big deal, and represent some of the most complex code, in one of my apps.

In fact, I just made a release last night, to try ensuring that we reduce the number of bad emails (I thought I could get away with eschewing the traditional “confirm email” thing —I was wrong. There’s a reason the classics are popular).

Since it is an iOS app, I can implement Sign in/up with Apple, which helps a lot.

It’s still a work in progress, though. I use the Keychain to store login info, with Face/Touch ID, to smooth the login process. Works fairly well.

Re: The "email is authentication" pattern

#282

Post by sensanaty »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I despise magic links. The rare few times I have to log back into Notion or Slack, I want to rip my hair out because of how annoying of a system it is.

Please, for the love of god, just let me use my username/email and password. Have the magic link for the dummies that don't use a password manager if you have to, just let me do the username + password way.

Re: The "email is authentication" pattern

#283

Post by alkonaut »

j-bos wrote: post #139
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I don't know, we carried physical money for millenia. Humans managed that.

Yes and people quickly realized that there is an amount they don’t want to carry around. No one carries their life savings and few would even keep it in a safe in their house.

Re: The "email is authentication" pattern

#284

Post by alkonaut »

candiddevmike wrote: post #29
tptacek wrote: post #3

Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

It does solve a lot of this. Some have gov’t issued IDs, others have a hybrid public/private system where banks issue the ids. But yes, a de facto standard electronic ID is almost unthinkable to not have. How else do you interact with authorities or healthcare? I used e-ID since long before smartphones, I can barely picture what it would be like to log in to handle taxes, benefits medicine recipes or doctors appointments if it worked any other way.

Re: The "email is authentication" pattern

#287

Post by homebrewer »

mewpmewp2 wrote: post #228
archerx wrote: post #224

Earlier quoted context omitted.

Remembering passwords is easy this is just just convoluted and stupid.

Since you wouldn't want to reuse passwords how is it to remember them?

You'll be surprised how many diceware passwords you're able to remember.

It can go two ways depending on your preferences: use a shorter passphrase generated from a large dictionary; a good one can be obtained from 1password:

https://1password.com/txt/agwordlist.txt

https://1password.com/password-generator

or a longer passphrase from a short dictionary including only the most common words, like the EFF one:

https://www.eff.org/dice

https://secure.research.vt.edu/diceware/#eff

I don't use either generator, preferring a local command:

  $ shuf --random-source /dev/urandom --head-count 5 ~/.local/share/words |
    paste --serial --delimiters -
wrapped in a small helper script with desktop notifications and copy-to-clipboard.

Re: The "email is authentication" pattern

#288

Post by fooker »

imron wrote: post #84
echoangle wrote: post #73

Earlier quoted context omitted.

Can you elaborate on „email sending isn’t free“? What are you using to host the webapp? Can’t you just set up your own mail server and send whatever you want?

Generally, no, unless you don’t care whether it’s delivered or not Too many people and companies abused this to the point that running your own mail server means much of the generic mail you send will end up in junk/spam folders.

It won’t even be delivered in most cases.

Re: The "email is authentication" pattern

#289

Post by thepra »

at least for my privacy conscious web apps I don't even expect email for login, just a username and password.

And if people really want to enable password recovery then they add their email into their profile and that data point is only used for that.

It might bother some, but I don't really want to require emails for privacy related services. My two cents.

Re: The "email is authentication" pattern

#290

Post by kookamamie »

> I think people can’t answer why they do this because it’s not a concious decision

It's because that's simply the most convenient way of accessing the service. There are tens of services people use these days and passwords are seen as a nuisance. If there's an easier way of logging in, people will use it - no matter the security implications.

Post reply on HN