Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

311–320 of 474 posts

Re: The "email is authentication" pattern

#311

Post by adastra22 »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I don’t have access to my email on the computer in which I am trying to login to your web service.

Re: The "email is authentication" pattern

#312

Post by adastra22 »

archerx wrote: post #223
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I hate this with a passion and many sites use it like anthropic and clipdrop, I stopped buying credits on Clipdrop because logging in was so annoying. My email is on my phone and I want to access the site on my laptop. This adds so much friction and turns a 5 second task with one to two clicks into a longer than a minute task with many clicks. I emailed anthropic about this and they did added a login with google opti…

Christ, login with Google? I don’t have a Google account either. Why can’t they just have a username/password like the rest of the world?

Re: The "email is authentication" pattern

#313

Post by adastra22 »

byteflip wrote: post #61
dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

I'm coding up a webapp with this exact login process - the issue I've found is on mobile phones - apps like gmail won't let you copy the link into a browser without a preview. The preview consumes the link. (next.js auth) It's a bit annoying, since I don't want to login into the gmail in-app browser, I want to login on my regular browser.

Pleas don’t force this login method. It is extremely annoying for anyone with a non-standard email setup (often for security reasons), and is slow as all hell.

Why make things worse for your users?

Re: The "email is authentication" pattern

#314

Post by btilly »

afastow wrote: post #294
throwaway290 wrote: post #261

Earlier quoted context omitted.

It is not equally secure, if bank loses you money you have recourse, if bank loses your key (a fire, a flood) it's gone.

I stay away from everything crypto but I don't see the difference. In both cases if they didn't make it right you'd go to the courts and make your case that they are at fault and owe you compensation.

The history of crypto says, "Good luck!"

There is a long history here of once trusted institutions turning out to be fraudulent.

Re: The "email is authentication" pattern

#315

Post by archerx »

lbriner wrote: post #307
archerx wrote: post #229

Earlier quoted context omitted.

I have stopped giving websites money because the friction of using magic links was too much and I found alternatives that didn’t involve such a dumb login system. My theory is if you can’t make a proper login system you’re skills probably aren’t good enough to deliver on what you’re promising. Magic links have turned from an annoyance to a filter for me.

"My theory is if you can’t make a proper login system you’re skills probably aren’t good enough to deliver on what you’re promising." Using that logic, I wouldn't trust most websites I visit. Even FAANG companies with their billions can't do certain things properly. Even something reallly basic like focus the 2FA box when you ask for the code, don't make me have to click on it! Don't stop people pasting passwords, do…

Don’t look at FAANG as examples, they are usually the leaders in modern day bad UX.

Re: The "email is authentication" pattern

#316

Post by Rygian »

fragmede wrote: post #51
Rygian wrote: post #35

Earlier quoted context omitted.

> Who copy and pastes from a password manager? Me. I don't know of any other LAN-only method that works consistently across my various desktop and mobile devices.

okay, but you're using xclip/pbpaste/equivalent, yeah?

Ctrl-C and Ctrl-V work consistently on Windows + Linux. For Android, almost same experience with KeePassDroid that shows notifications to Ctrl-C the user and the password.

Re: The "email is authentication" pattern

#317

Post by throwaway290 »

afastow wrote: post #300
kgwgk wrote: post #296

Earlier quoted context omitted.

In the first case, bank deposits are insured. In the second case, safe deposit boxes are not insured.

They're just different things. The FDIC insurance is for if the bank itself goes insolvent and they literally don't have enough money to cover their depositors' balances anymore. There's no reason a safe deposit box would be affected.

A fire, a flood, a robbery...

Re: The "email is authentication" pattern

#318

Post by throwaway290 »

cooljoseph wrote: post #301
kriops wrote: post #274

Earlier quoted context omitted.

Shamir it.

I don't understand why this was downvoted. In case it's not clear: (S)he's saying to split the key into multiple shares that can be used to reconstruct the key if you have a large enough quorum. Then store each share in a different place. As long as you don't lose too many of the shares, you'll be fine. And one baddie is NOT enough to get the key.

Either shuffling those keys stored in N different deposit boxes is overly complicated for a normal person, or it is not overly complicated for a moderately dedicated baddie either

Re: The "email is authentication" pattern

#319

Post by witrak »

jerf wrote: post #111
JonChesterfield wrote: post #106

Earlier quoted context omitted.

One flaw is I'm pretty sure a lot gmail account is lost forever. Contacting Google to retrieve access would not go well. Related is that if you try to self host email your messages are unlikely to reach anyone.

Self-hosting outbound email is hard. Self-hosting inbound email is trivial. Anybody will send email to any random domain, they're just not willing to accept it from random sources. And the latter is what is relevant for password recovery. I self-host inbound but use established servers for outbound through my ISP and have had no trouble with that setup for a while. Forwarding to people through my domain has gotten a…

>Self-hosting inbound email is trivial. Anybody will send email to any random domain, they're just not willing to accept it from random sources.

That is simply not true. I have self-hosted email service and starting about 1.5 yr ago some big email services don't deliver emails to my server anymore. And there are many similar cases reported...

So one can say that even if an independent email service is willing to accept email traffic from any sender it does not guarantee that customers of all other services can have delivered their emails to addresses at the service.

Re: The "email is authentication" pattern

#320

Post by paxys »

j-bos wrote: post #139
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

I don't know, we carried physical money for millenia. Humans managed that.

Banks have been a thing almost as long as money.
Post reply on HN