[dead]
The "email is authentication" pattern
321–330 of 474 posts
Re: The "email is authentication" pattern
#322Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way. When designing a "fantasy football" alternate authentication system for the Internet, start wit…
> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…
>> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans.
>This has been my single biggest argument against fiat currency stuff for years: the "lose your money, lose your money" thing is fundamentally incompatible with real users. Humans need to be able to recover from their mistakes.
And yet, for the very longest time, it was the default position for humans.
Re: The "email is authentication" pattern
#323Earlier quoted context omitted.
Or maybe password managers need to catch up with this newly forming flow
Perhaps, a password manager managed email address used solely for these stupid links and codes. Why email then? Why not some other, better protocol? Why not just use a TOTP at that point?
> Why not just use a TOTP at that point?
Friction. When the username is an email address, 100% of people logging in have an email address. Telling someone they need to setup TOTP, especially if they have never done so before, is going to be a bridge too far for something they may only use once or twice.
One site I remember using this email code login was a small online store. If I was prompted to setup TOTP to buy something, I would have probably not bought anything. If my mom was prompted for that, she’d end up calling me, and I’d have to try to walk her through the whole thing… then I’d keep getting calls the next 5 times she’s had to login.
If the site gives directions on what to do, they will probably only be written targeting a single authenticator app. For people who don’t yet know that the apps are generic (in most cases), this can lead to a user having 3 sites setup in 3 different apps. It can become a mess very quickly.
Re: The "email is authentication" pattern
#324I’ve seen sites that cut out the forgotten password step, or passwords entirely… email is the authentication. 1. Type in email address 2. Get sent and email with code 3. Enter code to login While I can understand why someone might do this, as someone with multiple emails I kind of hate it. I had to add it to my password manager with the email and a note, so I remember which one to use and it’s not missing a password.
I would say a huge proportion of non-technical consumers do not use a password manager. By only offering password signup and not magic links/codes, I am probably making life harder for the vast majority of consumers.
Even if I offer both options, I would guess that I’d see more drop off during my signup flow by asking for a password as well as verifying their email. Not to mention the code is way simpler without dealing with passwords and multiple login flows for email.
Re: The "email is authentication" pattern
#325In general, I really am disturbed that so many websites use my email and phone number for authentication. I use authenticator and password manager apps for a reason. Using my email and phone number is both unsafe and was never approved by me. They just started doing it. Further, there's no way to turn it off.
Re: The "email is authentication" pattern
#326What are the other potential problems of the "email is authentication"
pattern, under the following prescribed conditions? Maybe just these
two?
(Prescribed Conditions)
- "Credential Recovery" complies with OWASP ASVS and is "adequately secure".
- "Credential Recovery" is the "weakest link" of authentication. (Other authentication methods require TOTP, etc.)
(Potential Problems)
- The financial cost of sending emails.
- my guess is that, since I could not find of news of this issue,
these users are only a small percentage (hopeful not yet)
- my guess is that users who choose "Credential Recovery"
authentication over other "happy-path" authentication are willing
to wait, or are use to waiting.
- If the above conditions are specified, authentication security is not compromised.
(Terms)
- "Credential Recovery" as in OWASP ASVS V2.5 Credential Recovery, or "Self-service password reset" as in Wikipedia, or "forgot password" flow.
https://en.wikipedia.org/w/index.php?title=Self-service_pass... https://owasp.org/www-project-application-security-verificat... https://github.com/OWASP/ASVS/raw/v4.0.3/4.0/OWASP%20Applica...
- "adequately secure" as in NIST SP 800-160 Vol. 1 Rev. 1, 3. System Security Concepts, 3.2. The Concept of an Adequately Secure System.
https://csrc.nist.gov/pubs/sp/800/160/v1/r1/final https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
Re: The "email is authentication" pattern
#327The idea that someone is going to invent and remember a password for every dumb service is not real, and when you build another password based authentication system, you are doing a kind of LARP. Passwords are used in one of two ways: 1. a password manager guarded by a single actual password 2. the same password repeated between services Practically every service offers e-mail recovery, so, in practice, your e-mail i…
Apple has made the incredibly annoying “you can’t just enter your 1Password/keychain password, you have to dick around with email” process much nicer; at least when it can recognize the email/text and enter the code for you.
Apple is the worst about this. The only option is that they send a message to an Apple device. I only have an iPad and not an iPhone or Macbook, so I often simply cannot log into my Apple account because they refuse to do anything else besides send it to an Apple device.
Re: The "email is authentication" pattern
#328For most people, doing stuff on computers is a matter of brute forcing it until kinda does what it's supposed to. Software is made by people who have an intricate understanding of how the underlying system works, but it's made for people who don't. When users get to a pattern that works, they stick with it. It's becoming even more common now that many schools are using tablets for education - they don't get a good feel for how a computer works. Most people don't think about it. It's just there, and they're used to things being broken, so what's a few extra clicks?
Re: The "email is authentication" pattern
#329How do you deal with the situation that you lost access to an email address (e.g. change of employer) and years later you want access to an account that turns out to be tied to that email address?
Re: The "email is authentication" pattern
#330Earlier quoted context omitted.
Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.
My wife works in a city clerk's office. They provide (among other things) vital records services for the city. Like getting birth certificates. To get a birth certificate, you must provide government photo ID with a name matching that of one of the names on the certificate you're trying to get . So you can get your own, or your child's, but not some random other person's. Lots of people were born before RealID driver…
How did he get a driver's licence with the name "Sam"? Don't you need some form of judicial process to change your name on this kind of thing?